Search
Search Results (413875 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79956 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95704 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95705 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95718 | 2026-10-23 | 5.3 Medium | ||
| No description provided | ||||
| CVE-2026-95721 | 2026-10-23 | 3.3 Low | ||
| No description provided | ||||
| CVE-2026-115351 | 2 Lepture, Mistune Project | 2 Mistune, Mistune | 2026-10-23 | 4.7 Medium |
| Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values. | ||||
| CVE-2026-114613 | 1 Msgpack | 1 Msgpack-python | 2026-10-23 | 7.5 High |
| MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3. | ||||
| CVE-2026-115484 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-10-23 | 7.6 High |
| A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration. | ||||
| CVE-2026-96376 | 1 Drupal | 1 Cloud | 2026-10-23 | 6.4 Medium |
| Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1. | ||||
| CVE-2026-114625 | 1 Arista | 1 Velocloud Orchestrator | 2026-10-23 | 9.9 Critical |
| VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched. | ||||
| CVE-2026-79860 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79861 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79863 | 2026-10-23 | 9.6 Critical | ||
| No description provided | ||||
| CVE-2026-79865 | 2026-10-23 | 9.6 Critical | ||
| No description provided | ||||
| CVE-2026-79866 | 2026-10-23 | 9.6 Critical | ||
| No description provided | ||||
| CVE-2026-79867 | 2026-10-23 | 9.6 Critical | ||
| No description provided | ||||
| CVE-2026-79868 | 2026-10-23 | 9.6 Critical | ||
| No description provided | ||||
| CVE-2026-79871 | 2026-10-23 | 9.6 Critical | ||
| No description provided | ||||
| CVE-2026-79875 | 2026-10-23 | 9.3 Critical | ||
| No description provided | ||||
| CVE-2026-79878 | 2026-10-23 | 8.8 High | ||
| No description provided | ||||