Export limit exceeded: 410276 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410276 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79836 | 2026-10-15 | 6.4 Medium | ||
| A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure. | ||||
| CVE-2026-79835 | 2026-10-15 | 2.8 Low | ||
| A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server. | ||||
| CVE-2026-79834 | 2026-10-15 | 7.4 High | ||
| A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution. | ||||
| CVE-2026-79833 | 2026-10-15 | 7.5 High | ||
| A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service. | ||||
| CVE-2026-79832 | 2026-10-15 | 7.6 High | ||
| A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash. | ||||
| CVE-2026-79831 | 2026-10-15 | 6.6 Medium | ||
| A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution. | ||||
| CVE-2026-79830 | 2026-10-15 | 6.6 Medium | ||
| A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution. | ||||
| CVE-2026-79829 | 2026-10-15 | 8.2 High | ||
| A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt. | ||||
| CVE-2026-79828 | 2026-10-15 | 7.1 High | ||
| A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-79827 | 2026-10-15 | 7.1 High | ||
| A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-79826 | 2026-10-15 | 7.1 High | ||
| A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. | ||||
| CVE-2026-79825 | 2026-10-15 | 7.1 High | ||
| A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-79823 | 2026-10-15 | 4 Medium | ||
| HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior. | ||||
| CVE-2026-77364 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-15 | 6.5 Medium |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths. | ||||
| CVE-2026-6432 | 1 Silicon Labs | 1 Sisdk | 2026-10-15 | N/A |
| Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown. | ||||
| CVE-2026-63315 | 1 Slican | 1 Ipx | 2026-10-15 | N/A |
| WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100. | ||||
| CVE-2026-63314 | 1 Slican | 1 Ipx | 2026-10-15 | N/A |
| WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100. | ||||
| CVE-2026-57118 | 1 Mervinpraison | 2 Praisonai, Praisonaiagents | 2026-10-15 | 9.8 Critical |
| PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59. | ||||
| CVE-2026-53997 | 1 Netherman | 1 Portal Del Hermano (portaldelhermano.es) | 2026-10-15 | 7.4 High |
| Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents. | ||||
| CVE-2026-53882 | 2026-10-15 | N/A | ||
| An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later | ||||