Export limit exceeded: 420036 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420036 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119655 | 1 Coreshop | 1 Coreshop | 2026-10-30 | 7.5 High |
| CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders. | ||||
| CVE-2026-119647 | 1 Dromara | 1 Ruoyi-vue-plus | 2026-10-30 | 4.3 Medium |
| RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks. | ||||
| CVE-2026-119644 | 1 Wangyunf | 1 Blossom | 2026-10-30 | 5.4 Medium |
| Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status. | ||||
| CVE-2026-49116 | 2026-10-30 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49115 | 2026-10-30 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-112556 | 1 Apple | 1 Macos | 2026-10-30 | 4.8 Medium |
| A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context. | ||||
| CVE-2026-113947 | 1 Apple | 1 Macos | 2026-10-30 | 8.8 High |
| This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution. | ||||
| CVE-2026-83719 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-30 | 5.5 Medium |
| Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-106634 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-30 | 7.7 High |
| Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-107305 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-30 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-103092 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. | ||||
| CVE-2026-83699 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-30 | 7.8 High |
| Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-104309 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-104314 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response. | ||||
| CVE-2026-104316 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check. | ||||
| CVE-2026-104328 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-104339 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-107328 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 9.9 Critical |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. | ||||
| CVE-2026-110190 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system. | ||||
| CVE-2026-110193 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server. | ||||