Export limit exceeded: 415509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15958 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112906 | 1 Tox-dev | 1 Filelock | 2026-10-27 | 4.7 Medium |
| filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-118174 | 1 Mozilla | 1 Thunderbird | 2026-10-27 | N/A |
| When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | ||||
| CVE-2026-117917 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-27 | N/A |
| Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-16307 | 1 Netiket Information Technologies | 1 Edoweb | 2026-10-27 | 4.3 Medium |
| Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7. | ||||
| CVE-2026-106438 | 1 Mongodb | 1 C Driver | 2026-10-27 | 4 Medium |
| An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value. | ||||
| CVE-2026-116672 | 1 Authlib | 1 Authlib | 2026-10-27 | 8.8 High |
| Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1. | ||||
| CVE-2026-117982 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-118009 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-108142 | 1 Veeam | 1 Backup And Replication | 2026-10-27 | N/A |
| A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. | ||||
| CVE-2026-98147 | 1 Linux | 1 Linux Kernel | 2026-10-27 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthread_run failure. Since __kthread_create_on_node() returns -EINTR upon SIGKILL, we should not use WARN_ON() in order to catch kthread_run() failure. | ||||
| CVE-2026-98148 | 1 Linux | 1 Linux Kernel | 2026-10-27 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations The rotation argument to drm_plane_create_rotation_property() is set to DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as the supported_rotations argument. The driver never validates that GUD_ROTATION_0 is present, so a device that omits it from its GUD_PROPERTY_ROTATION triggers the WARN_ON(rotation & ~supported_rotations) in drm_plane_create_rotation_property() Fix this by skipping the creation of rotation property if the device doesn't have the GUD_ROTATION_0 bit | ||||
| CVE-2026-87086 | 2026-10-27 | 7.5 High | ||
| Tanium addressed a denial of service vulnerability in Provision. | ||||
| CVE-2026-108331 | 2026-10-27 | 3.3 Low | ||
| Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-103576 | 1 Microsoft | 9 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 6 more | 2026-10-27 | 6.5 Medium |
| Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-109431 | 1 Camunda | 1 Camunda 7 | 2026-10-27 | 8.1 High |
| Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments. | ||||
| CVE-2026-14255 | 1 Autodesk | 2 Revit, Shared Components | 2026-10-27 | 5.5 Medium |
| A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file. | ||||
| CVE-2026-93434 | 1 Watchguard | 1 Fireware Os | 2026-10-27 | N/A |
| An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request. | ||||
| CVE-2026-116746 | 2 Qloapps, Webkul | 2 Qloapps, Qloapps | 2026-10-27 | 5.3 Medium |
| QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers. | ||||
| CVE-2026-116894 | 1 Redaxo | 2 Core, Redaxo | 2026-10-27 | 4.2 Medium |
| REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months. | ||||
| CVE-2026-116898 | 1 Redaxo | 2 Core, Redaxo | 2026-10-27 | 7.1 High |
| REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide. | ||||