Export limit exceeded: 410367 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410367 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89058 | 1 Redhat | 22 Apicurio Registry, Build Keycloak, Build Of Apache Camel For Quarkus and 19 more | 2026-10-19 | 7.4 High |
| A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality. | ||||
| CVE-2026-109737 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.1 High |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109766 | 1 Mozilla | 1 Firefox | 2026-10-19 | 8.1 High |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-110324 | 1 Gitea | 1 Gitea | 2026-10-19 | N/A |
| The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0. | ||||
| CVE-2026-110494 | 1 Gitea | 1 Gitea | 2026-10-19 | N/A |
| Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it. | ||||
| CVE-2026-111407 | 2 Themeum, Wordpress-extensions | 2 Tutor Lms, Tutor Lms | 2026-10-19 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2. | ||||
| CVE-2026-112157 | 1 Memtensor | 1 Memmy-agent | 2026-10-19 | 3.1 Low |
| A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of the file Memory/src/server/http.ts of the component Memory Service. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The exploit is partially overstated. While "POST /api/v1/admin/shutdown" accepts unauthenticated requests when no token is configured, it’s designed for local use and later received cross-origin fixes. Unauthenticated endpoint exposure is confirmed; browser-triggered DoS remains likely but depends on specific browser behavior. | ||||
| CVE-2026-12254 | 2026-10-19 | N/A | ||
| Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142 | ||||
| CVE-2026-100791 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.8 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-102466 | 1 Eclipse | 1 Vert.x | 2026-10-19 | N/A |
| In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application. The impacted component is io.vertx:vertx-mysql-client. | ||||
| CVE-2026-100792 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 7.1 High |
| JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | ||||
| CVE-2026-112309 | 2026-10-19 | 7.5 High | ||
| @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart. | ||||
| CVE-2026-112304 | 2026-10-19 | 7.5 High | ||
| docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6. | ||||
| CVE-2026-100793 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 6.5 Medium |
| JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100794 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 9.6 Critical |
| Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | ||||
| CVE-2026-100795 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 6.5 Medium |
| Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100796 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.8 High |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100797 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.8 High |
| Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-77228 | 2026-10-19 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-77227 | 2026-10-19 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||