Export limit exceeded: 110584 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (110584 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85969 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 7.1 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data. | ||||
| CVE-2026-85968 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 7.1 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory. | ||||
| CVE-2026-85952 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 8.5 High |
| Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials. | ||||
| CVE-2026-85951 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 8.5 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens. | ||||
| CVE-2026-65150 | 1 Nvidia | 1 Dali | 2026-10-15 | 7.3 High |
| NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service. | ||||
| CVE-2026-65149 | 1 Nvidia | 1 Dali | 2026-10-15 | 7.3 High |
| NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering. | ||||
| CVE-2026-65147 | 1 Nvidia | 1 Dali | 2026-10-15 | 7.3 High |
| NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service. | ||||
| CVE-2026-111220 | 1 Netgate | 1 Pfsense | 2026-10-15 | 7.2 High |
| pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule. | ||||
| CVE-2026-109753 | 1 Mozilla | 1 Firefox | 2026-10-15 | 8.1 High |
| Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109733 | 1 Mozilla | 1 Firefox | 2026-10-15 | 8.1 High |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109730 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-15 | 8.8 High |
| Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-108185 | 1 Zoom Communications | 1 Zoom Clients | 2026-10-15 | 7.4 High |
| Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access. | ||||
| CVE-2026-108184 | 1 Zoom Communications | 1 Zoom Clients | 2026-10-15 | 7.4 High |
| Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access. | ||||
| CVE-2026-67223 | 2 Broadcom, Rabbitmq | 2 Rabbitmq Server, Rabbitmq-server | 2026-10-15 | 7.1 High |
| RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes ${username} into user_dn_pattern without RFC 4514 DN escaping, allowing a crafted username to alter the LDAP bind DN and potentially select a different directory entry. Exploitation requires rabbitmq_auth_backend_ldap with a user_dn_pattern containing ${username}, a directory layout in which the injected suffix resolves usefully, and a password valid for the resulting DN. The advisory body identifies 3.13.15, 4.0.20, 4.1.11, 4.2.9, and 4.3.3 as fixed, while structured metadata identifies 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. No fixed-version assertion is certifiable until a curator resolves this conflict. | ||||
| CVE-2026-30754 | 1 Ffmpeg | 1 Ffmpeg | 2026-10-15 | 8.8 High |
| A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer. | ||||
| CVE-2026-95702 | 1 Google | 1 Gvisor | 2026-10-15 | 7.8 High |
| Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries. | ||||
| CVE-2026-85975 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 7.5 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection. | ||||
| CVE-2026-85966 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 7.7 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources. | ||||
| CVE-2026-85965 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 8 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability. | ||||
| CVE-2026-85964 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-15 | 7.7 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files. | ||||