Export limit exceeded: 424998 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424998 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123509 | 1 Vikunja | 1 Vikunja | 2026-11-10 | 4.3 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load. | ||||
| CVE-2026-123505 | 1 Vikunja | 1 Vikunja | 2026-11-10 | 5.5 Medium |
| Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline. | ||||
| CVE-2026-123501 | 1 Vikunja | 1 Vikunja | 2026-11-10 | 6.5 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill. | ||||
| CVE-2026-123497 | 1 Vikunja | 1 Vikunja | 2026-11-10 | 6.8 Medium |
| Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic. | ||||
| CVE-2026-123493 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-10 | 5.4 Medium |
| Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds. | ||||
| CVE-2026-123322 | 1 Jetbrains | 1 Webstorm | 2026-11-10 | 6.3 Medium |
| In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader | ||||
| CVE-2026-123320 | 1 Jetbrains | 1 Toolbox | 2026-11-10 | 3.1 Low |
| In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server | ||||
| CVE-2026-123319 | 1 Jetbrains | 1 Ktor | 2026-11-10 | 3.7 Low |
| In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection | ||||
| CVE-2026-123318 | 1 Jetbrains | 1 Ktor | 2026-11-10 | 4.8 Medium |
| In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine | ||||
| CVE-2026-123315 | 1 Jetbrains | 1 Junie | 2026-11-10 | 7 High |
| In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option | ||||
| CVE-2026-123087 | 1 Atmira | 1 Sirec | 2026-11-10 | N/A |
| SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information. | ||||
| CVE-2026-121824 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | N/A |
| A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service. | ||||
| CVE-2026-121823 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | N/A |
| A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and access protected resources. | ||||
| CVE-2026-121822 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | N/A |
| A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing. | ||||
| CVE-2026-121821 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | N/A |
| A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials. | ||||
| CVE-2026-121820 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | 7.5 High |
| A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service. | ||||
| CVE-2026-121819 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | 4.4 Medium |
| A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbolic link inside an allowed directory points outside it. In deployments using a credential injector, header-compatible text secrets may be exposed to an attacker-observable upstream. | ||||
| CVE-2026-121611 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Els | 2026-11-10 | 6.5 Medium |
| A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content. | ||||
| CVE-2026-121006 | 1 Libwww-perl | 1 Http-body | 2026-11-10 | 7.5 High |
| HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer. | ||||
| CVE-2026-120474 | 1 Undici | 1 Undici | 2026-11-10 | 6.5 Medium |
| undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. | ||||