Export limit exceeded: 425103 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425103 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425103 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-66368 | 1 Samsung Semiconductor | 3 Exynos 1080, Exynos 9110, Exynos Modem 5123 | 2026-11-11 | 7.5 High |
| Incorrect handling of SDP payload leads to a Denial of Service | ||||
| CVE-2026-93404 | 2026-11-11 | 8.1 High | ||
| A flaw was found in rsyslog. The built-in ClickHouse output templates fail to properly escape backslash characters when formatting Structured Query Language (SQL) queries. An attacker capable of submitting crafted log messages routed to an affected ClickHouse action can exploit this issue to alter executed SQL commands, potentially leading to unauthorized database modification or information disclosure. | ||||
| CVE-2026-124408 | 2026-11-11 | 5.4 Medium | ||
| Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22. | ||||
| CVE-2026-125439 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0. | ||||
| CVE-2026-125777 | 2026-11-11 | 5.3 Medium | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6. | ||||
| CVE-2026-124413 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4. | ||||
| CVE-2026-123180 | 2026-11-11 | 8.8 High | ||
| A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This affects the confidentiality, integrity and availability of the router. | ||||
| CVE-2026-115600 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. | ||||
| CVE-2026-122671 | 2026-11-11 | 6.5 Medium | ||
| Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.32.65. | ||||
| CVE-2026-124271 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3. | ||||
| CVE-2026-91203 | 1 Redhat | 1 Enterprise Linux | 2026-11-11 | 6 Medium |
| A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable. | ||||
| CVE-2026-19685 | 1 Redhat | 7 Enterprise Linux, Hardened Images, Hummingbird and 4 more | 2026-11-11 | 7.1 High |
| NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point. | ||||
| CVE-2026-124743 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 5.5 Medium |
| A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution. | ||||
| CVE-2026-124742 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 5.5 Medium |
| A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations. | ||||
| CVE-2026-124740 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 4.3 Medium |
| A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests. | ||||
| CVE-2026-124738 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 5.3 Medium |
| A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files. | ||||
| CVE-2026-8639 | 1 Ibm | 2 Security Verify Directory, Verify Directory | 2026-11-11 | 8.8 High |
| IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console. | ||||
| CVE-2026-89119 | 2026-11-11 | 9.6 Critical | ||
| SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability. | ||||
| CVE-2026-89103 | 2026-11-11 | 10 Critical | ||
| SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system. | ||||
| CVE-2026-82830 | 1 Ibm | 1 Guardium Data Protection | 2026-11-11 | 6.7 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters. | ||||