Export limit exceeded: 417564 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417564 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417564 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55614 | 2026-10-30 | N/A | ||
| uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue. | ||||
| CVE-2026-55612 | 2026-10-30 | 3.7 Low | ||
| uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue. | ||||
| CVE-2026-79864 | 1 Hpe | 1 Aos | 2026-10-30 | 9.6 Critical |
| Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-107250 | 2026-10-30 | 5.9 Medium | ||
| Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | ||||
| CVE-2026-62335 | 1 Openvm-org | 1 Openvm | 2026-10-30 | N/A |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` accepts `appExeCommit` and `appVmCommit` as `bytes32` values without checking that either is less than the `BN254` scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. | ||||
| CVE-2026-62333 | 1 Openvm-org | 1 Openvm | 2026-10-30 | N/A |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. | ||||
| CVE-2026-116853 | 2 Nexcess, Wordpress-extensions | 2 Givewp, Givewp | 2026-10-30 | 6.5 Medium |
| Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | ||||
| CVE-2026-119729 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-10-30 | 6.5 Medium |
| A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service. | ||||
| CVE-2026-119343 | 1 Stirling | 1 Stirling Pdf | 2026-10-30 | 6.8 Medium |
| Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0. | ||||
| CVE-2026-62804 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-30 | 7.8 High |
| External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-85893 | 1 Microsoft | 1 Edge Chromium | 2026-10-30 | 8.8 High |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-55613 | 2026-10-30 | N/A | ||
| uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue. | ||||
| CVE-2026-81396 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-10-30 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-73013 | 1 Microsoft | 22 Office, Windows 10 1607, Windows 10 1809 and 19 more | 2026-10-30 | 8.8 High |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69499 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 8.8 High |
| Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-64918 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-10-30 | 6.5 Medium |
| Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-69610 | 1 Microsoft | 22 Office 365, Office Macos 2021, Office Macos 2024 and 19 more | 2026-10-30 | 7 High |
| Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68880 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 8 High |
| Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-77491 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-10-30 | 5.5 Medium |
| Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-69576 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 7.8 High |
| Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally. | ||||