Export limit exceeded: 413909 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413909 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413909 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55889 | 1 Flatpak | 1 Xdg-desktop-portal | 2026-10-23 | N/A |
| XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1. | ||||
| CVE-2026-55459 | 2026-10-23 | 7.4 High | ||
| The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05. | ||||
| CVE-2026-54615 | 1 Part-db | 1 Part-db | 2026-10-23 | N/A |
| Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat() runs user-controlled strings through htmlspecialchars() before placing them into the HTML it returns — except the CollectionElementDeleted branch, which interpolates getOldName() (and getCollectionName()) into a sprintf() template with no escaping. The returned string is emitted by LogEntryExtraColumn::render() and inserted as raw HTML into the DataTables cell (the bundle does not escape column output; sibling columns call htmlspecialchars() themselves). CollectionElementDeleted.getOldName() is the name of a deleted collection sub-element — a part Parameter, Attachment, PartLot, Orderdetail, etc. — all freely set by any user with edit rights on the owning element. A low-privileged content editor can therefore store an HTML/script payload as the name of such a sub-element, delete it (which writes the log entry), and have that markup parsed as live DOM in the browser of a higher-privileged victim (an administrator/auditor with system.show_logs, or any user viewing that element's history). This is a stored cross-site-scripting / HTML-injection defect caused by a single missed sanitizer in one sibling branch. CSP policies block inline javascript execution under normal conditions. This issue has been patched in version 2.12.1. | ||||
| CVE-2026-115727 | 1 Fosowl | 1 Agenticseek | 2026-10-23 | 8.1 High |
| AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges. | ||||
| CVE-2026-115449 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-10-23 | 3.5 Low |
| A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide. | ||||
| CVE-2026-115398 | 2 Nationalsecurityagency, Nsa | 2 Ghidra, Ghidra | 2026-10-23 | 5.5 Medium |
| Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session. | ||||
| CVE-2026-115394 | 2 Nationalsecurityagency, Nsa | 2 Ghidra, Ghidra | 2026-10-23 | 5.5 Medium |
| Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit length field. Attackers can persuade users to import a crafted GZF packed database file, triggering an OutOfMemoryError in PackedDatabase.open() that aborts the import and denies service. | ||||
| CVE-2026-115390 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-23 | 5.7 Medium |
| Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service. | ||||
| CVE-2026-115386 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-23 | 2.6 Low |
| Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry. | ||||
| CVE-2026-115382 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-23 | 4.8 Medium |
| Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing the host embedding. | ||||
| CVE-2026-115378 | 1 Linuxcontainers | 1 Incus | 2026-10-23 | 5.8 Medium |
| Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host. | ||||
| CVE-2026-115374 | 1 Linuxcontainers | 1 Incus | 2026-10-23 | 7.1 High |
| Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags. | ||||
| CVE-2026-115370 | 1 Linuxcontainers | 1 Incus | 2026-10-23 | 4.3 Medium |
| Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services. | ||||
| CVE-2026-115364 | 1 Openbao | 1 Openbao | 2026-10-23 | 2.2 Low |
| OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services. | ||||
| CVE-2026-115356 | 1 Openbao | 1 Openbao | 2026-10-23 | 5.4 Medium |
| OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to authenticate is still valid. An authenticated attacker can keep renewing such tokens to persist access after the Kubernetes service account has been deleted. | ||||
| CVE-2026-115333 | 1 Uselotus | 1 Lotus | 2026-10-23 | 5.9 Medium |
| Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing. | ||||
| CVE-2026-115329 | 1 Uselotus | 1 Lotus | 2026-10-23 | 5.9 Medium |
| Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing. | ||||
| CVE-2026-115325 | 2 Gravitl, Netmaker | 2 Netmaker, Netmaker | 2026-10-23 | 8.3 High |
| Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys. | ||||
| CVE-2026-115321 | 1 Bytebase | 1 Bytebase | 2026-10-23 | 4.3 Medium |
| Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access. | ||||
| CVE-2026-114663 | 1 Vyperlang | 1 Vyper | 2026-10-23 | 8.4 High |
| Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic. | ||||