Export limit exceeded: 11091 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11091 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95768 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 5.3 Medium |
| A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitive information from the affected system. | ||||
| CVE-2026-123064 | 2026-11-09 | 8.8 High | ||
| The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges. | ||||
| CVE-2026-0016 | 1 Google | 1 Android | 2026-11-09 | 3.3 Low |
| In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-120834 | 2026-11-09 | 7.3 High | ||
| Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17. | ||||
| CVE-2026-121576 | 2026-11-09 | 8.8 High | ||
| Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1. | ||||
| CVE-2026-95737 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 8.2 High |
| A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system. | ||||
| CVE-2026-95752 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 7.1 High |
| A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system. | ||||
| CVE-2026-124621 | 1 Kongxin-github | 1 Java Library Management System | 2026-11-09 | 7.4 High |
| A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-121843 | 1 Mozilla | 1 Firefox For Ios | 2026-11-09 | 8.8 High |
| Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0. | ||||
| CVE-2026-121419 | 1 Surrealdb | 1 Surrealdb | 2026-11-09 | 8.1 High |
| SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions. | ||||
| CVE-2026-119506 | 2026-11-09 | 9.1 Critical | ||
| Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1. | ||||
| CVE-2026-95753 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 7.1 High |
| A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer. | ||||
| CVE-2023-41715 | 1 Sonicwall | 61 Nsa2700, Nsa3700, Nsa4700 and 58 more | 2026-11-09 | 8.8 High |
| SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel. | ||||
| CVE-2026-86921 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-09 | 6.2 Medium |
| A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files. | ||||
| CVE-2026-112168 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets. | ||||
| CVE-2026-124590 | 1 Zhangbw409 | 1 Library Manager System | 2026-11-09 | 7.3 High |
| A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-124574 | 1 Chenyme | 1 Grok2api | 2026-11-09 | 6.3 Medium |
| A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component. | ||||
| CVE-2026-124569 | 1 Fushengqian | 1 Fuintcatering | 2026-11-09 | 5.4 Medium |
| A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124568 | 1 Fushengqian | 1 Fuintcatering | 2026-11-09 | 4.3 Medium |
| A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124565 | 1 Fushengqian | 1 Fuint | 2026-11-09 | 4.3 Medium |
| A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||