Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423918 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126066 | 2026-11-10 | 3.7 Low | ||
| fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0. | ||||
| CVE-2026-120828 | 2026-11-10 | 7.5 High | ||
| A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable. | ||||
| CVE-2026-120826 | 2026-11-10 | 6.5 Medium | ||
| An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard. | ||||
| CVE-2026-120825 | 2026-11-10 | 6.5 Medium | ||
| An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material. | ||||
| CVE-2026-126065 | 2026-11-10 | 9.8 Critical | ||
| OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0. | ||||
| CVE-2026-120824 | 2026-11-10 | 8.8 High | ||
| A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. | ||||
| CVE-2026-120823 | 2026-11-10 | 4.3 Medium | ||
| A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information. | ||||
| CVE-2026-125729 | 2026-11-10 | N/A | ||
| Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header. Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block. | ||||
| CVE-2026-125349 | 2026-11-10 | 3.4 Low | ||
| Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-125346 | 2026-11-10 | 8.8 High | ||
| Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-125342 | 2026-11-10 | 4.7 Medium | ||
| Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-124308 | 1 Fraunhoferhhi | 1 Vvdec | 2026-11-10 | 5.8 Medium |
| Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more threads, causing heap memory corruption or a decoder crash. | ||||
| CVE-2026-124026 | 2 Barassistant, Karlomikus | 2 Bar Assistant, Bar-assistant | 2026-11-10 | 4.3 Medium |
| Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar. | ||||
| CVE-2026-120822 | 2026-11-10 | 6.7 Medium | ||
| MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog. | ||||
| CVE-2026-116606 | 1 Barracuda Networks | 1 Barracuda Email Security Gateway | 2026-11-10 | N/A |
| An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. | ||||
| CVE-2026-120821 | 2026-11-10 | 6.5 Medium | ||
| A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly. | ||||
| CVE-2026-111560 | 1 Barracuda Networks | 6 Barracuda Email Security Gateway, Barracuda Load Balancer Application Delivery Controller, Barracuda Message Archiver and 3 more | 2026-11-10 | N/A |
| Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. | ||||
| CVE-2026-126064 | 2026-11-10 | N/A | ||
| Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5. | ||||
| CVE-2026-120820 | 2026-11-10 | 4.3 Medium | ||
| MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process. | ||||
| CVE-2026-120818 | 2026-11-10 | 7.1 High | ||
| A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability. | ||||