Export limit exceeded: 413936 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413936 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413936 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84419 | 1 Citrix | 1 Workspace App For Windows | 2026-10-22 | N/A |
| Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1. | ||||
| CVE-2026-110359 | 1 Hyland | 1 Desktop Host | 2026-10-22 | 7.8 High |
| Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges. | ||||
| CVE-2026-79821 | 1 Hpe | 1 Nonstop Soap 4.0 | 2026-10-22 | 8.2 High |
| A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down. | ||||
| CVE-2026-79824 | 1 Hpe | 1 Nonstop Python 3.x | 2026-10-22 | 8 High |
| A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive. | ||||
| CVE-2026-79825 | 1 Hpe | 1 Nonstop Ndsrest | 2026-10-22 | 7.1 High |
| A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-39989 | 1 Qnap Systems | 1 Download Station | 2026-10-22 | N/A |
| A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later | ||||
| CVE-2026-39991 | 1 Qnap Systems | 1 Notes Station | 2026-10-22 | N/A |
| A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later | ||||
| CVE-2026-39997 | 1 Qnap Systems | 1 Hybriddesk Station | 2026-10-22 | N/A |
| A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later | ||||
| CVE-2026-79826 | 1 Hpe | 1 Nonstop Ocax | 2026-10-22 | 7.1 High |
| A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. | ||||
| CVE-2026-79840 | 1 Hpe | 1 Nonstop Xabroker | 2026-10-22 | 7.3 High |
| A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash. | ||||
| CVE-2026-79843 | 1 Hpe | 1 Nonstop Sql/mx Exe | 2026-10-22 | 6.5 Medium |
| A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption. | ||||
| CVE-2026-109681 | 1 Rapid7 | 1 Metasploit | 2026-10-22 | 4.7 Medium |
| The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host. | ||||
| CVE-2026-109682 | 1 Rapid7 | 1 Metasploit | 2026-10-22 | 4.7 Medium |
| Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker. | ||||
| CVE-2026-110899 | 2 Kevin Stover, Wordpress-extensions | 2 Ninja Forms, Ninja Forms | 2026-10-22 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5. | ||||
| CVE-2026-54427 | 1 Apache | 1 Brpc | 2026-10-22 | N/A |
| Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix. | ||||
| CVE-2026-115330 | 1 Uselotus | 1 Lotus | 2026-10-22 | 8.8 High |
| Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants. | ||||
| CVE-2026-114510 | 1 Stevereiner | 1 Flexible-graphrag | 2026-10-22 | 7.1 High |
| Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2. | ||||
| CVE-2026-16477 | 1 Mtw | 1 Cleanshot X | 2026-10-22 | N/A |
| CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10 | ||||
| CVE-2026-61791 | 1 Schorschii | 1 Oco-server | 2026-10-22 | 7.4 High |
| OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname into a JavaScript string in an inline `onclick` handler, using `htmlspecialchars(ENT_QUOTES)` only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. `frontend/views/computer-details.php` passes `$computer->hostname` to this helper using `Computer::DEFAULT_COMPUTER_COMMANDS` in `lib/Models/Computer.class.php`, whose VNC, RDP, SSH, and Ping entries use `new_tab=false` and the vulnerable `window.location` branch. A remote attacker who possesses the shared `agent-registration-key` can use the `oco.agent.hello` handler in `frontend/api-agent.php` to store an unchecked hostname when `agent-self-registration-enabled` is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1. | ||||
| CVE-2026-114603 | 1 Opentelemetry | 1 Opentelemetry-python | 2026-10-22 | 5.3 Medium |
| OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1. | ||||