Export limit exceeded: 10714 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 30087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30087 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95775 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 3.3 Low |
| A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to read certain files on the underlying operating system. | ||||
| CVE-2026-95774 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 3.7 Low |
| A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. | ||||
| CVE-2026-95771 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 4.3 Medium |
| An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system. | ||||
| CVE-2026-95770 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 4.7 Medium |
| A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information from the affected system. | ||||
| CVE-2026-95767 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 5.3 Medium |
| An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system. | ||||
| CVE-2026-95766 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 5.3 Medium |
| Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sensitive information. | ||||
| CVE-2026-86959 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-09 | 4.3 Medium |
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination. | ||||
| CVE-2026-95750 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 7.5 High |
| An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials. | ||||
| CVE-2026-95734 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 8.8 High |
| A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system. | ||||
| CVE-2026-121038 | 1 Google | 1 Chrome | 2026-11-09 | 6.5 Medium |
| Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-111454 | 1 Apache | 1 Airflow | 2026-11-09 | N/A |
| Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later. | ||||
| CVE-2026-119613 | 1 Ash-project | 1 Ash Ai | 2026-11-09 | N/A |
| Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller. This issue affects ash_ai: from 1.5.0 before 1.5.1. | ||||
| CVE-2026-124587 | 1 Elizaos | 1 Eliza | 2026-11-09 | 4.3 Medium |
| A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue. | ||||
| CVE-2026-66984 | 1 Hcltech | 1 Aion | 2026-11-09 | 3.1 Low |
| HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2023-3640 | 2 Linux, Redhat | 3 Linux Kernel, Enterprise Linux, Rhel Els | 2026-11-09 | 7 High |
| A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled. However, despite this feature, there is still a risk of per-cpu entry area leaks. This issue could allow a local user to gain access to some important data with memory in an expected location and potentially escalate their privileges on the system. | ||||
| CVE-2026-101506 | 1 Oracle | 1 Trusted Answer Search | 2026-11-09 | 7.7 High |
| Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search. While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). | ||||
| CVE-2026-101494 | 1 Oracle | 1 Rest Data Services | 2026-11-08 | 7.7 High |
| Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). | ||||
| CVE-2026-97194 | 1 Wordpress-extensions | 1 Secure Custom Fields | 2026-11-08 | 2.7 Low |
| The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts. | ||||
| CVE-2026-122060 | 1 Wordpress-extensions | 1 Wp Recipe Maker | 2026-11-08 | 5.3 Medium |
| The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts. | ||||
| CVE-2026-104337 | 2026-11-08 | 5.3 Medium | ||
| The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs. | ||||