Export limit exceeded: 30000 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413267 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413267 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-114119 | 1 Best Practice Software | 1 Bp Premier | 2026-10-22 | 9.8 Critical |
| Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM. | ||||
| CVE-2026-114197 | 1 Mandiant Flare | 1 Capa | 2026-10-22 | N/A |
| Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility | ||||
| CVE-2026-114198 | 1 Mandiant Flare | 1 Floss | 2026-10-22 | N/A |
| Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility | ||||
| CVE-2026-114391 | 1 Easysoft | 1 Zentaopms | 2026-10-22 | 7.1 High |
| ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables. | ||||
| CVE-2026-113779 | 1 Pfrest | 1 Pfsense-pkg-restapi | 2026-10-22 | 8.8 High |
| The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses. | ||||
| CVE-2026-113787 | 1 Githubnewbie0 | 1 Odf-kit | 2026-10-22 | 6.1 Medium |
| odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch. | ||||
| CVE-2026-113788 | 1 Uselagoon | 1 Lagoon | 2026-10-22 | N/A |
| Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used. | ||||
| CVE-2026-113799 | 1 Abdolence | 1 Slack-morphism-rust | 2026-10-22 | 5.3 Medium |
| Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret. Version 2.28.0 patches the issue. | ||||
| CVE-2026-53986 | 1 Girafit | 1 Girafit Camera App | 2026-10-22 | 5.3 Medium |
| Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password. | ||||
| CVE-2026-96379 | 1 Drupal | 1 Cookiecuttr | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3. | ||||
| CVE-2026-87942 | 1 Drupal | 1 Safedelete | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88. | ||||
| CVE-2026-87941 | 1 Drupal | 1 Patreon | 2026-10-22 | N/A |
| Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | ||||
| CVE-2026-87940 | 1 Drupal | 1 Key Auth | 2026-10-22 | N/A |
| Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4. | ||||
| CVE-2026-87939 | 1 Drupal | 1 Feed Block | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2. | ||||
| CVE-2026-87938 | 1 Drupal | 1 Csp Log | 2026-10-22 | N/A |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2. | ||||
| CVE-2026-87936 | 1 Drupal | 1 Amazee.ai Private Ai Provider | 2026-10-22 | N/A |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3. | ||||
| CVE-2026-84921 | 1 Drupal | 1 Webform Submissions Delete | 2026-10-22 | N/A |
| Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-81163 | 1 Drupal | 1 Media Library Importer | 2026-10-22 | N/A |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6. | ||||
| CVE-2026-16648 | 1 Drupal | 1 Mailer Plus Log | 2026-10-22 | N/A |
| Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7. | ||||
| CVE-2026-84917 | 1 Drupal | 1 Jsonapi Role Access | 2026-10-22 | N/A |
| Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2. | ||||