Export limit exceeded: 424788 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424788 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105582 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-11-11 | 7 High |
| Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102868 | 1 Microsoft | 8 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 5 more | 2026-11-11 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-107496 | 1 Openssl | 1 Openssl | 2026-11-11 | N/A |
| Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service. CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns. The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop. OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option. The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected. The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely. FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached. | ||||
| CVE-2026-124694 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established. | ||||
| CVE-2026-121737 | 2026-11-11 | N/A | ||
| When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could free that pipelined stream while resetting the connection's streams on the resulting write timeout, then go on to use it. This can crash the server, leading to denial of service, and may allow memory corruption with further impact. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-124693 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established. | ||||
| CVE-2026-124692 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established. | ||||
| CVE-2026-124690 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110. | ||||
| CVE-2026-124689 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established. | ||||
| CVE-2026-124688 | 2026-11-11 | 7.1 High | ||
| In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session. | ||||
| CVE-2026-126722 | 2026-11-11 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface. | ||||
| CVE-2026-126723 | 2026-11-11 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface. | ||||
| CVE-2026-126724 | 2026-11-11 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface. | ||||
| CVE-2026-126720 | 2026-11-11 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface. | ||||
| CVE-2026-103582 | 1 Apache | 1 Activemq Nms Openwire Client Library | 2026-11-11 | 7.5 High |
| Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the network. It did not enforce a maximum frame size, and it did not check that decoded lengths fit within the frame being read. A malicious or compromised broker, or an attacker able to intercept and modify an unencrypted connection, could send a crafted OpenWire frame with an oversized or negative length. This could cause the client to attempt very large memory allocations, leading to excessive memory consumption, an OutOfMemoryException or an uncaught exception, and a denial of service of the client application. Users are recommended to upgrade to version 2.3.0, which enforces a configurable maximum frame size and validates lengths against the size of the frame being read. | ||||
| CVE-2025-66366 | 1 Samsung Semiconductor | 10 Exynos 1280, Exynos 1330, Exynos 1380 and 7 more | 2026-11-11 | 7.5 High |
| Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash | ||||
| CVE-2025-29940 | 2026-11-11 | N/A | ||
| Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity. | ||||
| CVE-2026-124687 | 2026-11-11 | 7.1 High | ||
| In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111. | ||||
| CVE-2026-122043 | 2026-11-11 | N/A | ||
| repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When event_notification_command is configured, repmgr substitutes the %a (node name), %c (connection string) and %d (details) placeholders into the command and runs it through the shell. %a and %c are inserted without escaping, and %d escapes only double quotes, so shell command substitution still works inside the quoting the documentation recommends. The node name and connection string come from node records in the repmgr.nodes table. An attacker with the credentials of a non-superuser repmgr database user can write a crafted node record and run OS commands, as the operating system user that runs repmgr or repmgrd (usually postgres), on other cluster nodes that process an event using these placeholders. The %a placeholder of failover_validation_command has the same flaw. Deployments whose repmgr database user is a superuser gain no new capability, because a superuser can already run OS commands, and deployments that do not use these placeholders are not affected. The issue is fixed in repmgr 5.5.1. After upgrading, operators must remove any quotes they placed around these placeholders, because a placeholder left inside double quotes is still open to command injection. | ||||
| CVE-2026-89061 | 1 Lenovo | 1 Pc Manager | 2026-11-11 | 7.8 High |
| During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that could allow a local user to escalate privileges. | ||||