Export limit exceeded: 419036 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419036 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2016-20057 | 1 Netgate | 2 Netgate Registry Cleaner, Registry Cleaner | 2026-10-27 | 7.8 High |
| NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges. | ||||
| CVE-2026-112521 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sandbox restrictions. | ||||
| CVE-2026-112488 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-27 | N/A |
| A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may corrupt process memory. | ||||
| CVE-2026-112512 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to bypass Gatekeeper checks. | ||||
| CVE-2026-112441 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-112608 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory. | ||||
| CVE-2026-112596 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-10-27 | N/A |
| An integer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected system termination. | ||||
| CVE-2026-112451 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service or disclose process memory. | ||||
| CVE-2026-116826 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 6.8 Medium |
| YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory. | ||||
| CVE-2026-116822 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 5.3 Medium |
| YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link. | ||||
| CVE-2026-116819 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 8.5 High |
| OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems. | ||||
| CVE-2026-116818 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 8.2 High |
| OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values. | ||||
| CVE-2026-116814 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 6.5 Medium |
| OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset. | ||||
| CVE-2026-116813 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 6.5 Medium |
| OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data. | ||||
| CVE-2026-116810 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 5.3 Medium |
| OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers. | ||||
| CVE-2026-116809 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 5.3 Medium |
| OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes. | ||||
| CVE-2026-116806 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 5.4 Medium |
| OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget. | ||||
| CVE-2026-116805 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 4.3 Medium |
| OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails. | ||||
| CVE-2026-116604 | 1 Sourcecodester | 1 Online Food Ordering System | 2026-10-27 | 6.5 Medium |
| A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-112554 | 1 Apple | 2 Ios And Ipados, Macos | 2026-10-27 | N/A |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||