Export limit exceeded: 418230 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418230 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15412 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-10-22 | 6.5 Medium |
| IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. | ||||
| CVE-2026-15396 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-10-22 | 6.5 Medium |
| IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. | ||||
| CVE-2026-13599 | 1 Abb | 1 Ability Edgenius | 2026-10-22 | 7.8 High |
| Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0. | ||||
| CVE-2026-11722 | 1 Ibm | 3 Cics Tx Advanced, Websphere Application Server, Websphere Application Server Liberty | 2026-10-22 | 4.8 Medium |
| IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-11549 | 1 Ibm | 3 Cics Tx Advanced, Websphere Application Server, Websphere Application Server Liberty | 2026-10-22 | 6.5 Medium |
| IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability. | ||||
| CVE-2026-11548 | 1 Ibm | 3 Cics Tx Advanced, Websphere Application Server, Websphere Application Server Liberty | 2026-10-22 | 4.8 Medium |
| IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-115496 | 2026-10-22 | N/A | ||
| Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible. | ||||
| CVE-2026-115494 | 2026-10-22 | N/A | ||
| A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests. | ||||
| CVE-2026-115387 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-22 | 6.2 Medium |
| Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host. | ||||
| CVE-2026-115383 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-22 | 4.8 Medium |
| Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled. | ||||
| CVE-2026-115381 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-22 | 4.8 Medium |
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service. | ||||
| CVE-2026-115379 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-22 | 5.7 Medium |
| Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution. | ||||
| CVE-2026-115361 | 1 Openbao | 1 Openbao | 2026-10-22 | 4.1 Medium |
| OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates within wildcard grants. Attackers whose identity metadata contains wildcard or path segments can access paths that should be denied within the broader wildcard-granted scope. | ||||
| CVE-2026-115357 | 1 Openbao | 1 Openbao | 2026-10-22 | 2.2 Low |
| OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection. | ||||
| CVE-2026-114570 | 1 Wordpress | 1 Wordpress | 2026-10-22 | 4.9 Medium |
| WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users. | ||||
| CVE-2026-114220 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 9.1 Critical |
| NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server. | ||||
| CVE-2026-114219 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 7.4 High |
| NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information. | ||||
| CVE-2026-114052 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-10-22 | 7.5 High |
| vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process. | ||||
| CVE-2026-114047 | 1 Freerdp | 1 Freerdp | 2026-10-22 | 6.8 Medium |
| FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data. | ||||
| CVE-2026-114042 | 1 Freerdp | 1 Freerdp | 2026-10-22 | 6.5 Medium |
| FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown. | ||||