Export limit exceeded: 410324 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410324 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107194 | 1 Sungrowpower | 1 Isolarcloud | 2026-10-19 | N/A |
| Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization. | ||||
| CVE-2026-86375 | 2026-10-19 | 6.2 Medium | ||
| Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-94231 | 1 Wordpress-extensions | 1 Truebooker | 2026-10-19 | 5.3 Medium |
| The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices. | ||||
| CVE-2026-64943 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-64944 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-64945 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-67249 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-71563 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-79624 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-112193 | 1 Webkul | 1 Aureus Erp | 2026-10-19 | 3.7 Low |
| A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-111063 | 2026-10-19 | N/A | ||
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4. | ||||
| CVE-2026-14511 | 1 Ibm | 1 Mq | 2026-10-19 | 6.5 Medium |
| IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications. | ||||
| CVE-2026-10572 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.8 High |
| IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options. | ||||
| CVE-2026-10574 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.8 High |
| IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. | ||||
| CVE-2026-11831 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 5.4 Medium |
| IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. | ||||
| CVE-2026-12148 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 7.5 High |
| IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. | ||||
| CVE-2025-10149 | 1 Wso2 | 5 Wso2 Carbon Scim 2.0 Common Component, Wso2 Carbon Scim Common Component, Wso2 Identity Server and 2 more | 2026-10-19 | 8.2 High |
| The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity. | ||||
| CVE-2026-12660 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 2.7 Low |
| IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. | ||||
| CVE-2026-12665 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.1 High |
| IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. | ||||
| CVE-2026-107082 | 2026-10-19 | N/A | ||
| Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction. | ||||