Export limit exceeded: 412571 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412571 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107755 | 1 Apache | 1 Couchdb | 2026-10-20 | N/A |
| Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue. | ||||
| CVE-2026-107929 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address | ||||
| CVE-2026-100132 | 1 Adobe | 1 Acrobat For Edge | 2026-10-20 | 4.3 Medium |
| Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | ||||
| CVE-2026-107928 | 1 Curl | 1 Curl | 2026-10-20 | 4.8 Medium |
| When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send. | ||||
| CVE-2026-105960 | 2026-10-20 | 5.5 Medium | ||
| PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. | ||||
| CVE-2026-110322 | 2026-10-20 | 5.5 Medium | ||
| The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing. | ||||
| CVE-2026-35499 | 2026-10-20 | 9.1 Critical | ||
| An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-9814 | 2026-10-20 | 9.1 Critical | ||
| An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-92391 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process. | ||||
| CVE-2026-103672 | 2026-10-20 | 7.1 High | ||
| The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. | ||||
| CVE-2026-92390 | 1 Curl | 1 Curl | 2026-10-20 | 6.5 Medium |
| When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint. | ||||
| CVE-2026-92389 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle. | ||||
| CVE-2026-92388 | 1 Curl | 1 Curl | 2026-10-20 | 6.5 Medium |
| When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer. | ||||
| CVE-2026-92387 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle. | ||||
| CVE-2026-101103 | 2026-10-20 | 5.5 Medium | ||
| The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. | ||||
| CVE-2026-92386 | 1 Curl | 1 Curl | 2026-10-20 | 4.3 Medium |
| When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file. | ||||
| CVE-2026-96656 | 1 Plex | 1 Media Server | 2026-10-20 | 7.2 High |
| Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks. | ||||
| CVE-2026-96655 | 1 Plex | 1 Media Server | 2026-10-20 | 4.3 Medium |
| Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. | ||||
| CVE-2026-96654 | 1 Plex | 1 Media Server | 2026-10-20 | 6.5 Medium |
| Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. | ||||
| CVE-2026-96652 | 1 Plex | 1 Media Server | 2026-10-20 | 4.3 Medium |
| Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. | ||||