Export limit exceeded: 412367 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412367 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87866 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key. | ||||
| CVE-2026-109576 | 2026-10-20 | 5.5 Medium | ||
| The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid. | ||||
| CVE-2026-87863 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss. | ||||
| CVE-2026-87864 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session. | ||||
| CVE-2026-87862 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS. | ||||
| CVE-2026-87861 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused. | ||||
| CVE-2026-86414 | 1 Curl | 1 Curl | 2026-10-20 | 6.5 Medium |
| An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`. | ||||
| CVE-2026-86413 | 1 Curl | 1 Curl | 2026-10-20 | 5.3 Medium |
| When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there. | ||||
| CVE-2026-86412 | 1 Curl | 1 Curl | 2026-10-20 | 5.3 Medium |
| A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains. | ||||
| CVE-2026-86411 | 1 Curl | 1 Curl | 2026-10-20 | 5.9 Medium |
| An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity. | ||||
| CVE-2026-113725 | 2026-10-20 | 7.8 High | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7. | ||||
| CVE-2026-113724 | 2026-10-20 | 4.5 Medium | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target's parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9. | ||||
| CVE-2026-113723 | 2026-10-20 | N/A | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9. | ||||
| CVE-2026-100208 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-20 | 7.5 High |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-113722 | 2026-10-20 | 7.8 High | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9. | ||||
| CVE-2026-113720 | 2026-10-20 | N/A | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9. | ||||
| CVE-2026-113715 | 2026-10-20 | N/A | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9. | ||||
| CVE-2026-113719 | 2026-10-20 | 4.5 Medium | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9. | ||||
| CVE-2026-113718 | 2026-10-20 | N/A | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9. | ||||
| CVE-2026-106159 | 1 Progress | 2 Kendo Ui, Kendo Ui For Jquery | 2026-10-20 | 4.7 Medium |
| In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the affected button is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015. | ||||