Export limit exceeded: 109214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109214 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77711 | 1 Eclipse | 1 Jetty | 2026-10-19 | 7.5 High |
| When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials. | ||||
| CVE-2026-110889 | 2 Gantry, Wordpress-extensions | 2 Gantry 5 Framework, Gantry 5 Framework | 2026-10-19 | 7.5 High |
| Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4. | ||||
| CVE-2026-112145 | 1 Speaches-ai | 1 Speaches | 2026-10-19 | 7.3 High |
| A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-109720 | 1 Mozilla | 1 Firefox | 2026-10-19 | 7.1 High |
| JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-81452 | 1 Dell | 1 Alienware Command Center | 2026-10-19 | 7 High |
| Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service. | ||||
| CVE-2026-69880 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-19 | 7.8 High |
| Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69882 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-19 | 7.8 High |
| Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-109760 | 1 Mozilla | 1 Firefox | 2026-10-19 | 8.1 High |
| Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-102551 | 1 Freertos | 1 Freertos-plus-tcp | 2026-10-19 | 7.7 High |
| Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2. | ||||
| CVE-2026-94167 | 2 Extendthemes, Wordpress-extensions | 2 Kubio Ai Page Builder, Kubio Ai Page Builder | 2026-10-19 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3. | ||||
| CVE-2026-110111 | 2 Vatesfr, Xen-orchestra | 2 Xen-orchestra, Xen Orchestra Server | 2026-10-19 | 7.5 High |
| Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution. | ||||
| CVE-2026-55601 | 1 Folkertvanheusden | 1 Multitail | 2026-10-19 | 7.3 High |
| MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review. | ||||
| CVE-2026-82715 | 1 Hitachi | 2 Hitachi Disk Array Driver For Aix, Hitachi Disk Array Driver For Virtual I/o Server | 2026-10-19 | 7.9 High |
| Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A. | ||||
| CVE-2026-110444 | 1 Teamplus Technology | 1 Teamplus Messenger | 2026-10-19 | 8.8 High |
| TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user. | ||||
| CVE-2026-110445 | 1 Teamplus Technology | 1 Teamplus Messenger | 2026-10-19 | 8.8 High |
| TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user. | ||||
| CVE-2026-73798 | 1 Hpe | 1 Nonstop Dns | 2026-10-19 | 8.2 High |
| A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service. | ||||
| CVE-2026-76655 | 1 Hpe | 1 Nonstop Snmp Trap Multiplexer | 2026-10-19 | 7.5 High |
| A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution | ||||
| CVE-2026-82026 | 1 Skyhook-io | 1 Radar | 2026-10-19 | 8.8 High |
| Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set. | ||||
| CVE-2026-110599 | 1 L-smash | 1 L-smash | 2026-10-19 | 7.1 High |
| L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes. | ||||
| CVE-2026-110633 | 1 Report One | 1 Myreport Updater | 2026-10-19 | 7.8 High |
| MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges. | ||||