Export limit exceeded: 393571 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (393571 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61908 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 3.1 Low |
| An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory. | ||||
| CVE-2026-87019 | 1 Tanium | 1 Comply | 2026-09-16 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87047 | 1 Tanium | 1 Comply | 2026-09-16 | 6.3 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-61909 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 3.5 Low |
| An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT. | ||||
| CVE-2026-69413 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-16 | 7 High |
| Use after free in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-87046 | 1 Tanium | 1 Comply | 2026-09-16 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87037 | 1 Tanium | 1 Comply | 2026-09-16 | 5.4 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87036 | 1 Tanium | 1 Comply | 2026-09-16 | 8.1 High |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-87035 | 1 Tanium | 1 Comply | 2026-09-16 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Comply. | ||||
| CVE-2026-61910 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 3.5 Low |
| An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.) | ||||
| CVE-2026-61911 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 4.3 Medium |
| An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery. | ||||
| CVE-2026-61915 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 4.2 Medium |
| An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties. | ||||
| CVE-2026-87034 | 1 Tanium | 1 Comply | 2026-09-16 | 8.3 High |
| Tanium addressed a SQL injection vulnerability in Comply. | ||||
| CVE-2026-92626 | 2026-09-16 | 7.5 High | ||
| Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an asynchronous method that returns void, so it is not observed by a caller and can terminate the iDSecure process. | ||||
| CVE-2026-69343 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-16 | 5.5 Medium |
| Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-92625 | 2026-09-16 | 7.5 High | ||
| Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable. | ||||
| CVE-2026-87017 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-09-16 | 4.3 Medium |
| Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1. | ||||
| CVE-2026-92615 | 1 Redhat | 2 Acm, Edge Manager | 2026-09-16 | 6.6 Medium |
| A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations. | ||||
| CVE-2026-70416 | 2026-09-16 | 10 Critical | ||
| Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | ||||
| CVE-2026-18709 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-09-16 | 6.4 Medium |
| An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees. | ||||