Export limit exceeded: 422178 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 30079 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30079 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95765 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 5.4 Medium |
| A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information. | ||||
| CVE-2026-71863 | 1 Freedomofpress | 1 Securedrop | 2026-11-09 | 2.6 Low |
| SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1. | ||||
| CVE-2026-123787 | 1 Nexmoe | 1 Vidbee | 2026-11-09 | 4.3 Medium |
| A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component. | ||||
| CVE-2026-118785 | 1 Nxp | 1 Mcuxpresso Sdk | 2026-11-09 | 6.7 Medium |
| Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channel, TOCTOU condition, or format-string misuse, potentially resulting in secure-world memory disclosure or denial of service. All software versions starting from 26.06.01-lts and 26.09.00 have fixed this issue. | ||||
| CVE-2026-118786 | 1 Nxp | 1 Mcuxpresso Sdk | 2026-11-09 | 6.8 Medium |
| Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and 26.09.00 may allow a non-secure caller to supply unvalidated pointers and size values, potentially resulting in disclosure of secure-world memory to the non-secure domain, or denial of service. All software versions starting from 26.06.01-lts and 26.12.00-pvw1 have fixed this issue. | ||||
| CVE-2026-123573 | 1 Hickory-dns | 1 Hickory-dns | 2026-11-09 | 7.5 High |
| hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process. | ||||
| CVE-2026-123574 | 1 Hickory-dns | 1 Hickory-dns | 2026-11-09 | 7.5 High |
| The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service. | ||||
| CVE-2026-95733 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 9.6 Critical |
| A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system. | ||||
| CVE-2026-95779 | 1 Hpe | 1 Morpheus Software | 2026-11-09 | 8.8 High |
| An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software. | ||||
| CVE-2026-123088 | 2026-11-09 | 5.3 Medium | ||
| The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address). | ||||
| CVE-2026-91917 | 1 Dell | 1 Openmanage Enterprise | 2026-11-09 | 8 High |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution. | ||||
| CVE-2026-55272 | 1 Google | 1 Android | 2026-11-09 | 6.2 Medium |
| In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-119274 | 1 Infoblox | 1 Nios | 2026-11-09 | 4.8 Medium |
| Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS | ||||
| CVE-2026-55262 | 1 Google | 1 Android | 2026-11-09 | 8.4 High |
| In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-70799 | 1 Oracle | 3 E-business Suite, Sdp Number Portability, Service Delivery Platform Number Portability | 2026-11-09 | 7.5 High |
| Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SDP Number Portability. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SDP Number Portability accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-124432 | 1 Thorsten | 1 Phpmyfaq | 2026-11-09 | 7.3 High |
| phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs. | ||||
| CVE-2026-121554 | 1 Silkimen | 1 Cordova-plugin-advanced-http | 2026-11-09 | 5.9 Medium |
| cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions. | ||||
| CVE-2026-121415 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-09 | 3.7 Low |
| Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields. | ||||
| CVE-2026-121411 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 3.1 Low |
| FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client. | ||||
| CVE-2026-121407 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 6.5 Medium |
| FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions. | ||||