Export limit exceeded: 417673 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417673 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417673 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417673 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417673 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118384 | 1 Gnu | 1 Mtools | 2026-10-31 | 6.1 Medium |
| GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. | ||||
| CVE-2026-116755 | 1 Softiron | 1 Hypercloud | 2026-10-31 | 7.4 High |
| Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18. | ||||
| CVE-2026-62147 | 1 Redhat | 1 Openshift Distributed Tracing | 2026-10-31 | 6.5 Medium |
| The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces. | ||||
| CVE-2026-116900 | 1 Redaxo | 2 Core, Redaxo | 2026-10-31 | 5.4 Medium |
| REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts. | ||||
| CVE-2026-116896 | 1 Redaxo | 2 Core, Redaxo | 2026-10-31 | 7.5 High |
| REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking. | ||||
| CVE-2026-116892 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 6.1 Medium |
| SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin. | ||||
| CVE-2026-116888 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 4.8 Medium |
| SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators. | ||||
| CVE-2026-116884 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 6.1 Medium |
| SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it. | ||||
| CVE-2026-116880 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 7.1 High |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion. | ||||
| CVE-2026-116876 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 7.1 High |
| Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out. | ||||
| CVE-2026-116872 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 7.5 High |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled. | ||||
| CVE-2026-116842 | 1 Diasurgical | 1 Devilutionx | 2026-10-31 | 6.1 Medium |
| DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game. | ||||
| CVE-2026-116828 | 1 Yeswiki | 1 Yeswiki | 2026-10-31 | 4.9 Medium |
| YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes. | ||||
| CVE-2026-116824 | 1 Yeswiki | 1 Yeswiki | 2026-10-31 | 6.1 Medium |
| YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions. | ||||
| CVE-2026-116820 | 1 Yeswiki | 1 Yeswiki | 2026-10-31 | 5.3 Medium |
| YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection. | ||||
| CVE-2026-116816 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-31 | 7.8 High |
| llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution. | ||||
| CVE-2026-116815 | 1 Openpanel | 1 Openpanel | 2026-10-31 | 4.3 Medium |
| OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint. | ||||
| CVE-2026-116811 | 1 Openpanel | 1 Openpanel | 2026-10-31 | 8.8 High |
| OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process. | ||||
| CVE-2026-116807 | 1 Openpanel | 1 Openpanel | 2026-10-31 | 6.5 Medium |
| OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects. | ||||
| CVE-2026-116803 | 1 Cure53 | 1 Dompurify | 2026-10-31 | 6.1 Medium |
| DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS. | ||||