Export limit exceeded: 424136 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424136 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91156 | 1 Discourse | 1 Discourse | 2026-10-22 | 7.5 High |
| Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9. | ||||
| CVE-2026-102893 | 1 Zulip | 1 Zulip | 2026-10-22 | N/A |
| Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false email_verified claim. If a configured identity provider returns an email address that the authenticating user does not control together with email_verified=false, Zulip can log the user into the existing account for that address. Exploitation requires a misconfigured trusted identity provider, and deployments whose authoritative identity provider only emits email addresses controlled by the authenticating user are not affected. This issue is fixed in version 12.2. | ||||
| CVE-2026-101966 | 1 Juniper Networks | 1 Junos Os Evolved | 2026-10-22 | 8.2 High |
| A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener. | ||||
| CVE-2026-103994 | 1 Juniper Networks | 1 Junos Os | 2026-10-22 | 8.8 High |
| A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution. | ||||
| CVE-2026-103946 | 1 Tenable | 1 Nessus | 2026-10-22 | 8.3 High |
| An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. | ||||
| CVE-2026-103993 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 6.8 Medium |
| An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise. | ||||
| CVE-2026-92151 | 1 Nasa | 1 Fprime | 2026-10-22 | 7.5 High |
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting and returning the buffer. When a CCSDS telecommand frame leaves a payload of six bytes or fewer after TcDeframer removes its header and trailer, the assertion aborts or resets the flight-software process, causing denial of service. This issue is fixed in version 4.2.0. | ||||
| CVE-2026-92153 | 1 Nasa | 1 Fprime | 2026-10-22 | 7.1 High |
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-101997 | 1 Juniper Networks | 1 Junos Os | 2026-10-22 | 8.1 High |
| An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection. | ||||
| CVE-2026-101996 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 6.5 Medium |
| A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message. | ||||
| CVE-2026-101936 | 1 Juniper Networks | 1 Junos Os | 2026-10-22 | 6.5 Medium |
| A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces. | ||||
| CVE-2026-101938 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 6.5 Medium |
| An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session. | ||||
| CVE-2026-101939 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 7.5 High |
| A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist. | ||||
| CVE-2026-101969 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 6.5 Medium |
| An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. | ||||
| CVE-2026-101970 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 6.5 Medium |
| A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. | ||||
| CVE-2026-75914 | 1 Hmbown | 1 Codewhale | 2026-10-22 | 7.5 High |
| CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval. | ||||
| CVE-2026-75773 | 1 Karakeep-app | 1 Karakeep | 2026-10-22 | 3.7 Low |
| A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component. | ||||
| CVE-2026-75872 | 1 Maalfer | 1 Mailerup | 2026-10-22 | N/A |
| HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email. | ||||
| CVE-2026-75778 | 1 Code-projects | 1 Task Management System | 2026-10-22 | 7.3 High |
| A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-75086 | 1 Itsourcecode | 1 Hospital Management System | 2026-10-22 | 6.3 Medium |
| A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||