Export limit exceeded: 416842 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416842 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111056 | 1 Fossbilling | 1 Fossbilling | 2026-10-19 | N/A |
| FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7. | ||||
| CVE-2026-97841 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-111899 | 1 Tombursch | 1 Kitchenowl | 2026-10-19 | 4.3 Medium |
| KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services. | ||||
| CVE-2026-111061 | 1 Eugeny | 1 Russh | 2026-10-19 | 4.3 Medium |
| russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1. | ||||
| CVE-2026-112310 | 1 Docling | 1 Docling-core | 2026-10-19 | 4.3 Medium |
| docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence. | ||||
| CVE-2026-111937 | 1 Frappe | 2 Crm, Frappe Crm | 2026-10-19 | 5.4 Medium |
| Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications. | ||||
| CVE-2026-112282 | 1 Videolan | 1 Libbluray | 2026-10-19 | 5.5 Medium |
| VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service. | ||||
| CVE-2026-112307 | 1 Sqlparse Project | 1 Sqlparse | 2026-10-19 | 7.3 High |
| sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs. | ||||
| CVE-2026-112363 | 2 Kidocode, Unclecode | 2 Crawl4ai, Crawl4ai | 2026-10-19 | 5.3 Medium |
| Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details. | ||||
| CVE-2026-34118 | 1 Tp-link | 3 Tapo C520ws, Tapo C520ws Firmware, Tapo C520ws V2 | 2026-10-19 | 6.5 Medium |
| A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C210 v3.6 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive. | ||||
| CVE-2026-97829 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-112285 | 1 Thelia | 1 Thelia | 2026-10-19 | 4.3 Medium |
| Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts. | ||||
| CVE-2026-112286 | 1 Krayin | 1 Laravel-crm | 2026-10-19 | 6.5 Medium |
| Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead. | ||||
| CVE-2026-111748 | 1 Aio-libs | 1 Aiohttp | 2026-10-19 | 6.5 Medium |
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4. | ||||
| CVE-2024-54657 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54656 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54655 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54654 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54653 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54652 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||