Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423918 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108712 | 1 Suitecrm | 1 Suitecrm | 2026-10-13 | 4.3 Medium |
| SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix. | ||||
| CVE-2026-108701 | 2 1panel-dev, Fit2cloud | 2 Cordyscrm, Cordys Crm | 2026-10-13 | 4.3 Medium |
| 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations. | ||||
| CVE-2026-108699 | 1 Hyper-mcp-rs | 1 Hyper-mcp | 2026-10-13 | 6.5 Medium |
| hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities. | ||||
| CVE-2026-108681 | 1 Zhayujie | 1 Cowagent | 2026-10-13 | 4.3 Medium |
| A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-108572 | 1 Casdoor | 1 Casdoor | 2026-10-13 | 4.3 Medium |
| A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component. | ||||
| CVE-2026-108568 | 1 Instantsoft | 1 Icms2 | 2026-10-13 | 4.3 Medium |
| A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108543 | 1 Ag2ai | 1 Ag2 | 2026-10-13 | 6.3 Medium |
| A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108539 | 1 Gpac | 1 Gpac | 2026-10-13 | 6.3 Medium |
| A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108521 | 1 Studio-saelix | 1 Sencho | 2026-10-13 | 4.7 Medium |
| A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration." | ||||
| CVE-2026-106047 | 1 Ivanti | 1 Xtraction | 2026-10-13 | 7.7 High |
| A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files. | ||||
| CVE-2026-106043 | 1 Ivanti | 1 Xtraction | 2026-10-13 | 7.5 High |
| A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. | ||||
| CVE-2026-106035 | 1 Ivanti | 1 Xtraction | 2026-10-13 | 5.5 Medium |
| An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log. | ||||
| CVE-2026-106034 | 1 Ivanti | 1 Xtraction | 2026-10-13 | 5 Medium |
| A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system. | ||||
| CVE-2026-109828 | 1 Libsndfile | 1 Libsndfile | 2026-10-13 | 4.3 Medium |
| A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-74030 | 1 Wazuh | 3 Wazuh, Wazuh-agent, Wazuh-manager | 2026-10-13 | 4.9 Medium |
| Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group. | ||||
| CVE-2026-106436 | 1 Mongodb | 1 Php Driver | 2026-10-13 | 4.8 Medium |
| The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required. | ||||
| CVE-2026-106432 | 1 Mongodb | 1 Php Driver | 2026-10-13 | 3.6 Low |
| The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required. | ||||
| CVE-2026-92702 | 1 Ultravioletrs | 1 Cocos | 2026-10-13 | 9.1 Critical |
| Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportData only when its caller supplies non-empty expected reportData. A relying-party integration that passes nil or empty expected reportData while relying on that value for current-session freshness can therefore accept SEV-SNP evidence unrelated to the current connection and make a trust, authorization, or application-data release decision for an unintended attestation context. This issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path as part of the migration to post-handshake attestation. | ||||
| CVE-2026-92701 | 1 Ultravioletrs | 1 Cocos | 2026-10-13 | 9.1 Critical |
| Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session value but does not apply it to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. The verifier can consequently accept structurally valid evidence containing mismatched or reused REPORT_DATA for the current TLS session, causing the relying party to release application data or make a trust or authorization decision for an unrelated attestation context. This issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path as part of the migration to post-handshake attestation. | ||||
| CVE-2026-84290 | 2 Ibm, Microsoft | 2 Guardium Data Protection, Windows | 2026-10-13 | 5.1 Medium |
| IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads. | ||||