Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423918 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97755 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2021 and 6 more | 2026-10-14 | 8.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105442 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-10-14 | 7.5 High |
| IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service. | ||||
| CVE-2026-102859 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 4.6 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-14888 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 8.1 High |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. | ||||
| CVE-2026-14988 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 6.5 Medium |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow. | ||||
| CVE-2026-14992 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 9.8 Critical |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow. | ||||
| CVE-2026-97782 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 6.8 Medium |
| Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. | ||||
| CVE-2026-102864 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 4.6 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-102862 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 8.8 High |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102861 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server Subscription Edition | 2026-10-14 | 8.8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-107361 | 1 Cisagov | 1 Malcolm | 2026-10-14 | 4.2 Medium |
| The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header. | ||||
| CVE-2026-14999 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 7.4 High |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures. | ||||
| CVE-2026-107337 | 1 Cisagov | 1 Malcolm | 2026-10-14 | 7.1 High |
| The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring. | ||||
| CVE-2026-107335 | 1 Cisagov | 1 Malcolm | 2026-10-14 | 6.5 Medium |
| Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users. | ||||
| CVE-2026-94587 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 4.5 Medium |
| A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon. | ||||
| CVE-2026-94586 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 6.8 Medium |
| A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges | ||||
| CVE-2026-94585 | 3 Broadcom, Brocade, Dell | 3 Fabric Operating System, Fabric Os, Mxg610s | 2026-10-14 | 8.8 High |
| An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface. | ||||
| CVE-2026-94581 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 6.8 Medium |
| An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system. | ||||
| CVE-2026-94579 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 8.0 High |
| An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes. | ||||
| CVE-2026-94577 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 7.8 High |
| A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root | ||||