Export limit exceeded: 425510 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425517 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-100229 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-11-12 | 6.5 Medium |
| No standard GStreamer pipeline element invokes the vulnerable parser API. Exploitation would require a third-party application to call it with attacker-controlled H.266 DCI data. | ||||
| CVE-2026-126996 | 1 Sakanaai | 1 Text-to-lora | 2026-11-12 | 6.3 Medium |
| A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-124250 | 2026-11-12 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202. | ||||
| CVE-2026-124257 | 2026-11-12 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1. | ||||
| CVE-2026-124253 | 2026-11-12 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Calculated Fields Form calculated-fields-form allows DOM-Based XSS.This issue affects Calculated Fields Form: from n/a through 5.5.2.8. | ||||
| CVE-2026-111824 | 1 Apache | 1 Roller | 2026-11-12 | N/A |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form. | ||||
| CVE-2026-118408 | 1 Apache | 1 Roller | 2026-11-12 | 3.1 Low |
| Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries. | ||||
| CVE-2026-118410 | 1 Apache | 1 Roller | 2026-11-12 | 3.7 Low |
| Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results. | ||||
| CVE-2026-118411 | 1 Apache | 1 Roller | 2026-11-12 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data. | ||||
| CVE-2026-118414 | 1 Apache | 1 Roller | 2026-11-12 | 5.4 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later. | ||||
| CVE-2026-109163 | 2 Apache, Apache Software Foundation | 3 Apache Http Server, Http Server, Apache Http Server | 2026-11-12 | 5.9 Medium |
| Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69. | ||||
| CVE-2026-106023 | 2 Apache, Apache Software Foundation | 3 Apache Http Server, Http Server, Apache Http Server | 2026-11-12 | N/A |
| NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69. | ||||
| CVE-2026-110992 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-12 | 6.5 Medium |
| A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host. | ||||
| CVE-2026-107509 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-12 | 6.5 Medium |
| A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value). | ||||
| CVE-2026-111000 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-12 | 7.1 High |
| A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management). | ||||
| CVE-2026-111024 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-12 | 7.1 High |
| A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization). | ||||
| CVE-2026-105440 | 2 Extreme Networks, Extremenetworks | 2 Switch Engine (exos), Switch Engine (exos) | 2026-11-12 | 6.5 Medium |
| Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure. | ||||
| CVE-2026-115819 | 1 The Gnu C Library | 1 Glibc | 2026-11-12 | 4.8 Medium |
| Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array. These conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination. The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library. | ||||
| CVE-2026-114569 | 1 Originlab | 1 Origin Viewer | 2026-11-12 | N/A |
| OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430. | ||||
| CVE-2026-15554 | 1 Redhat | 4 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els, Jboss Enterprise Application Platform Expansion Pack and 1 more | 2026-11-12 | 7.4 High |
| the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol. | ||||