Export limit exceeded: 11482 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 18160 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18160 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76498 | 1 Cisco | 1 Application Policy Infrastructure Controller (apic) | 2026-11-07 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284. | ||||
| CVE-2026-76478 | 1 Cisco | 4 Cisco Unified Communications Manager, Emergency Responder, Unified Communications Manager Im And Presence Service and 1 more | 2026-11-07 | 8.8 High |
| As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284. | ||||
| CVE-2026-76474 | 1 Cisco | 4 Cisco Unified Communications Manager, Emergency Responder, Unified Communications Manager Im And Presence Service and 1 more | 2026-11-07 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287. | ||||
| CVE-2026-76463 | 1 Cisco | 4 Campus Gateway Software, Meraki Mr Wireless Access Point Software, Meraki Mv Firmware and 1 more | 2026-11-07 | 8.8 High |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76463 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284. | ||||
| CVE-2026-76455 | 1 Cisco | 3 Cisco Nx-os System Software In Aci Mode, Nx-os Software, Unified Computing System Manager | 2026-11-07 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76455 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284. | ||||
| CVE-2026-76281 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-11-07 | N/A |
| As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76281 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284. | ||||
| CVE-2026-123991 | 1 Dataease | 1 Dataease | 2026-11-07 | 7.3 High |
| A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist." | ||||
| CVE-2026-123963 | 1 Openbmb | 1 Internet Of Agents | 2026-11-07 | 7.3 High |
| A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2023-3899 | 2 Fedoraproject, Redhat | 25 Fedora, Enterprise Linux, Enterprise Linux Desktop and 22 more | 2026-11-07 | 7.8 High |
| A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root. | ||||
| CVE-2026-123881 | 1 Openbmb | 1 Internet Of Agents | 2026-11-07 | 7.3 High |
| A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-17370 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed. | ||||
| CVE-2026-17358 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.2 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another. | ||||
| CVE-2026-17326 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.1 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | ||||
| CVE-2026-17158 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.9 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication. | ||||
| CVE-2026-95860 | 2026-11-07 | 9.1 Critical | ||
| node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0. | ||||
| CVE-2026-121585 | 1 Infiniflow | 1 Ragflow | 2026-11-07 | 4.3 Medium |
| A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-121539 | 1 Miroslavpejic85 | 1 Mirotalk P2p | 2026-11-07 | 6.3 Medium |
| A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component. | ||||
| CVE-2026-106991 | 2026-11-07 | 7.1 High | ||
| hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights. | ||||
| CVE-2026-101473 | 1 Oracle | 1 Agile Product Lifecycle Management For Process | 2026-11-07 | 8.1 High |
| Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-101571 | 1 Oracle | 1 Helidon | 2026-11-07 | 5.6 Medium |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper). Supported versions that are affected are 3.0.0-3.2.21 and 4.0.0-4.5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). | ||||