Export limit exceeded: 424162 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424162 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102474 | 3 Dash, Red Hat, Redhat | 4 Dash, Enterprise Linux, Enterprise Linux and 1 more | 2026-11-10 | 4 Medium |
| A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation. | ||||
| CVE-2026-95520 | 3 Red Hat, Redhat, Rpm | 7 Enterprise Linux, Enterprise Linux, Hardened Images and 4 more | 2026-11-10 | 7.1 High |
| A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. | ||||
| CVE-2026-73593 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2026-11-10 | 3 Low |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access. | ||||
| CVE-2026-73594 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2026-11-10 | 6.4 Medium |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass. | ||||
| CVE-2026-62146 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-11-10 | 7.8 High |
| A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape. | ||||
| CVE-2026-103242 | 3 Red Hat, Redhat, Rpm | 7 Enterprise Linux, Enterprise Linux, Hardened Images and 4 more | 2026-11-10 | 7.1 High |
| A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. | ||||
| CVE-2026-27371 | 2 Getwpfunnels, Wordpress-extensions | 2 Wpfunnels, Wpfunnels | 2026-11-10 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | ||||
| CVE-2026-97271 | 2 Getwpfunnels, Wordpress-extensions | 2 Wpfunnels, Wpfunnels | 2026-11-10 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | ||||
| CVE-2026-97286 | 2 Wordpress-extensions, Wpchill | 2 Strong Testimonials, Strong Testimonials | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11. | ||||
| CVE-2026-97287 | 2 Nexcess, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5. | ||||
| CVE-2026-97289 | 2 Expresstech, Wordpress-extensions | 2 Quiz And Survey Master, Quiz And Survey Master | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6. | ||||
| CVE-2026-103079 | 2 Ahmad, Wordpress-extensions | 2 Js Help Desk, Js Help Desk | 2026-11-10 | 5.4 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0. | ||||
| CVE-2026-105891 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 4.3 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||||
| CVE-2026-105893 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 5.3 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||||
| CVE-2026-95127 | 1 Libass | 1 Libass | 2026-11-10 | 7.5 High |
| An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | ||||
| CVE-2026-75826 | 1 Teltonika-networks | 14 Atrm, Cap, Dap and 11 more | 2026-11-10 | N/A |
| Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands. | ||||
| CVE-2026-109697 | 2 Brainstormforce, Wordpress-extensions | 2 Surecart, Surecart | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4. | ||||
| CVE-2026-20183 | 2026-11-10 | 4.3 Medium | ||
| A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials. | ||||
| CVE-2026-57084 | 1 Microsoft | 29 Office, Office 365, Office Macos 2021 and 26 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-57083 | 1 Microsoft | 28 Office, Office 365, Office Macos 2021 and 25 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally. | ||||