Export limit exceeded: 419084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419084 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113900 | 1 Apple | 1 Macos | 2026-11-03 | 7 High |
| A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | ||||
| CVE-2026-119426 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-11-03 | 7.5 High |
| phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication. | ||||
| CVE-2026-86977 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-03 | 7.5 High |
| An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages. | ||||
| CVE-2026-86976 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-03 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-41242 | 2 Protobuf, Protobufjs Project | 2 Protobuf, Protobufjs | 2026-11-03 | 9.8 Critical |
| protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue. | ||||
| CVE-2026-86955 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-03 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-118768 | 1 Randombit | 1 Botan | 2026-11-03 | N/A |
| Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0. | ||||
| CVE-2025-12767 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | 5.3 Medium |
| IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption. | ||||
| CVE-2025-36084 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | 5.9 Medium |
| IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2026-15915 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | 6.2 Medium |
| IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images. | ||||
| CVE-2026-101458 | 1 Oracle | 1 Siebel Crm Deployment | 2026-11-03 | 8.2 High |
| Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). | ||||
| CVE-2026-118760 | 1 Kubeflow | 1 Pipelines | 2026-11-03 | 6.5 Medium |
| Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0. | ||||
| CVE-2026-16426 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | 6.5 Medium |
| IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-119144 | 1 Frappe | 1 Frappe | 2026-11-03 | 8.8 High |
| Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context. | ||||
| CVE-2026-119719 | 1 Blender | 1 Blender | 2026-11-03 | 7.8 High |
| Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution. | ||||
| CVE-2026-17465 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | 6.5 Medium |
| IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper enforcement of storage limits. | ||||
| CVE-2026-17472 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | 9.6 Critical |
| IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions. | ||||
| CVE-2026-105947 | 1 Innotim Software Telecommunications And Consulting Trade Ltd. Co. | 1 Logsign Siem | 2026-11-03 | 6.5 Medium |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.120 before 6.4.122. | ||||
| CVE-2026-116214 | 2 Maccms, Magicblack | 2 Maccms, Maccms10 | 2026-11-03 | 9.1 Critical |
| MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account. | ||||
| CVE-2026-116215 | 2 Maccms, Magicblack | 2 Maccms, Maccms10 | 2026-11-03 | 3.1 Low |
| MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content. | ||||