Export limit exceeded: 410792 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410792 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97842 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-64286 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 8.2 High |
| In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2). Fix by clearing __hyp_running_vcpu after the copy. | ||||
| CVE-2026-64380 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 8.2 High |
| In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely. | ||||
| CVE-2026-96596 | 2 Erlang, Hexpm | 4 Erlang\/otp, Rebar3, Hex and 1 more | 2026-10-20 | 5.5 Medium |
| Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected. hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3. This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to stdlib from 8.0 before 8.1.1, and rebar3 from 3.27.1 onward, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1. | ||||
| CVE-2026-43848 | 2026-10-20 | N/A | ||
| A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. | ||||
| CVE-2026-43845 | 2026-10-20 | N/A | ||
| A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. | ||||
| CVE-2026-43844 | 2026-10-20 | N/A | ||
| A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. | ||||
| CVE-2026-43843 | 2026-10-20 | N/A | ||
| An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service. | ||||
| CVE-2026-43842 | 2026-10-20 | N/A | ||
| A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0. | ||||
| CVE-2026-43841 | 2026-10-20 | N/A | ||
| A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function. | ||||
| CVE-2026-43840 | 2026-10-20 | N/A | ||
| A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function. | ||||
| CVE-2026-43839 | 2026-10-20 | N/A | ||
| A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. | ||||
| CVE-2026-43838 | 2026-10-20 | N/A | ||
| A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | ||||
| CVE-2026-43837 | 2026-10-20 | N/A | ||
| A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. | ||||
| CVE-2026-43836 | 2026-10-20 | N/A | ||
| A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. | ||||
| CVE-2026-11960 | 2026-10-20 | N/A | ||
| Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts. | ||||
| CVE-2026-11959 | 2026-10-20 | N/A | ||
| Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens). | ||||
| CVE-2026-113469 | 2026-10-20 | 7.5 High | ||
| A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine. | ||||
| CVE-2026-113465 | 2026-10-20 | 6.6 Medium | ||
| It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link. | ||||
| CVE-2026-101201 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-10-20 | 5.5 Medium |
| A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. | ||||