Export limit exceeded: 106705 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (106705 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-33798 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-22 | 8.8 High |
| A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic. | ||||
| CVE-2026-92158 | 1 Nasa | 1 Fprime | 2026-10-22 | 7.2 High |
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0. | ||||
| CVE-2026-92154 | 1 Nasa | 1 Fprime | 2026-10-22 | 8.1 High |
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0. | ||||
| CVE-2026-92150 | 1 Nasa | 1 Fprime | 2026-10-22 | 7.5 High |
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0. | ||||
| CVE-2026-54554 | 1 Fogproject | 1 Fogproject | 2026-10-22 | 7.5 High |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870. | ||||
| CVE-2026-96914 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-22 | 8.8 High |
| Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96913 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-10-22 | 8.8 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96912 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-22 | 7.8 High |
| Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96911 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-22 | 7.8 High |
| Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-12080 | 2 Qemu, Redhat | 4 Qemu, Enterprise Linux, Enterprise Linux Nvidia and 1 more | 2026-10-22 | 7.3 High |
| A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path. | ||||
| CVE-2026-113394 | 1 Draytek | 2 Vigor2960, Vigor2960 Firmware | 2026-10-22 | 7.4 High |
| A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-113386 | 1 Roundcube | 1 Webmail | 2026-10-22 | 7.1 High |
| Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands. | ||||
| CVE-2026-112940 | 1 Tox-dev | 1 Filelock | 2026-10-22 | 7.1 High |
| filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-112897 | 1 Python-pillow | 1 Pillow | 2026-10-22 | 7.5 High |
| Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-111765 | 1 A2aproject | 1 A2a-java | 2026-10-22 | 7.5 High |
| A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with the PostBuilder default followRedirects value of true, leaving a residual of the earlier credential-redirect fix. JSONRPCTransport and RestTransport add interceptor-produced authentication headers and call synchronous post() without disabling redirects. AuthInterceptor permits X-API-Key, API-Key, X-Auth-Token, and X-Authentication headers; Android's repackaged OkHttp strips Authorization on cross-authority redirects but retains these nonstandard headers, disclosing a complete configured API key or token to another authority. The additional exposure applies when redirect or front-door behavior is compromised separately from the credential-handling component, or those components operate in different trust domains; a completely malicious initial origin already receives the credential on the first request. Autonomous clients require no human action, while user-invoked workflows can require interaction. Explicit followRedirects(false) prevents the redirected request. The demonstrated impact is credential disclosure, not subsequent credential use, integrity or availability impact, code execution, or host compromise. This issue is fixed in version 1.3.2.Final. | ||||
| CVE-2026-111594 | 2026-10-22 | 8.1 High | ||
| InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | ||||
| CVE-2026-109440 | 1 Ginlix-ai | 1 Langalpha | 2026-10-22 | 8.8 High |
| LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json. | ||||
| CVE-2026-108456 | 1 Microsoft | 1 Azure Ai Foundry | 2026-10-22 | 7.7 High |
| Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-98606 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 7.0 High |
| In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors virtio_gpu_vram_create() frees the object with a bare kfree(vram) on both error paths after drm_gem_private_object_init() has run, and on the second one after drm_gem_create_mmap_offset() has linked obj->vma_node into the device's VMA offset manager. The freed object stays in that interval tree, so a later lookup or insertion walks freed memory, and the dma_resv and gpuva lock are never destroyed. Call drm_gem_object_release() before kfree() on both paths. | ||||
| CVE-2026-91156 | 1 Discourse | 1 Discourse | 2026-10-22 | 7.5 High |
| Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9. | ||||