Export limit exceeded: 54207 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (54207 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109677 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 6.5 Medium |
| FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits. | ||||
| CVE-2026-109964 | 1 Imagemagick | 1 Imagemagick | 2026-10-13 | 5.6 Medium |
| ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution. | ||||
| CVE-2026-93294 | 2026-10-13 | 6.3 Medium | ||
| A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity. | ||||
| CVE-2026-108783 | 1 Prvtpro | 1 Amnezia-web-panel | 2026-10-13 | 7.3 High |
| A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108539 | 1 Gpac | 1 Gpac | 2026-10-13 | 6.3 Medium |
| A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-88833 | 2 Busybox, Redhat | 2 Busybox, Hummingbird | 2026-10-13 | 6.5 Medium |
| A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity. | ||||
| CVE-2026-84290 | 2 Ibm, Microsoft | 2 Guardium Data Protection, Windows | 2026-10-13 | 5.1 Medium |
| IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads. | ||||
| CVE-2026-64039 | 1 Linux | 1 Linux Kernel | 2026-10-13 | 7.7 High |
| In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and by accurately printing last registers in the region. While reworking the code also fix the 16x memory overallocation in msm_disp_state_dump_regs(). Patchwork: https://patchwork.freedesktop.org/patch/725449/ | ||||
| CVE-2026-109330 | 1 Network-ai | 1 Network-ai | 2026-10-13 | 4.3 Medium |
| Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets. | ||||
| CVE-2026-109305 | 1 Craftcms | 2 Cms, Craft Cms | 2026-10-13 | 8.8 High |
| Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user. | ||||
| CVE-2026-109265 | 1 Imagemagick | 1 Imagemagick | 2026-10-13 | 5.3 Medium |
| ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application. | ||||
| CVE-2026-109255 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 6.8 Medium |
| FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution. | ||||
| CVE-2026-109250 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 6.6 Medium |
| FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon. | ||||
| CVE-2026-108901 | 1 Shenzhen Hcc Technology | 1 Mpos M6 Plus | 2026-10-13 | 3.5 Low |
| A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108893 | 1 Linksys | 2 E1700, E1700 Firmware | 2026-10-13 | 9.9 Critical |
| A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-100763 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 9.1 Critical |
| Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-102408 | 1 Elastic | 1 Elasticsearch | 2026-10-13 | 4.3 Medium |
| Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue. | ||||
| CVE-2026-100764 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 8.8 High |
| Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-82162 | 1 Dell | 2 Command\|configure, Command|configure | 2026-10-13 | 7.4 High |
| Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2026-41504 | 1 Coraza | 1 Coraza | 2026-10-13 | 5.8 Medium |
| OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0. | ||||