Export limit exceeded: 416509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416514 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93008 | 1 Redhat | 4 Ceph Storage, Enterprise Linux, Openshift and 1 more | 2026-10-29 | 6.8 Medium |
| A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names. | ||||
| CVE-2026-42949 | 1 Frangoteam | 1 Frangoteam | 2026-10-29 | 5.6 Medium |
| A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-118665 | 1 Ardatan | 2 Executor-legacy-ws, Graphql-tools | 2026-10-29 | N/A |
| GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package. | ||||
| CVE-2026-118666 | 1 Ardatan | 2 Executor-legacy-ws, Graphql-tools | 2026-10-29 | N/A |
| GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user's authorized subscription payload while the earlier caller's stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package. | ||||
| CVE-2026-118682 | 1 Karingx | 1 Clashmi | 2026-10-29 | 7.5 High |
| KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs. | ||||
| CVE-2026-118689 | 1 Ovenmedialabs | 1 Ovenmediaengine | 2026-10-29 | 7.5 High |
| OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay. | ||||
| CVE-2026-118691 | 1 Gudong2003 | 1 Xianyu-auto-reply-fix | 2026-10-29 | 3.7 Low |
| xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account. | ||||
| CVE-2026-118752 | 2 Danoli3, Freeimage Project | 2 Freeimage, Freeimage | 2026-10-29 | 7.8 High |
| FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap. | ||||
| CVE-2026-118753 | 2 Danoli3, Freeimage Project | 2 Freeimage, Freeimage | 2026-10-29 | 7.8 High |
| FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK. | ||||
| CVE-2026-118756 | 1 Gopasspw | 1 Gopass | 2026-10-29 | 5.5 Medium |
| gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees. | ||||
| CVE-2026-118803 | 1 Bricks | 1 Bricks Theme | 2026-10-29 | 7.5 High |
| Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication. | ||||
| CVE-2026-61546 | 1 Ankimcp | 1 Anki-mcp-server-addon | 2026-10-29 | N/A |
| AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `tools/list` and `tools/call` reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to `initialize` MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless `enabled_destructive_tools` is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0. | ||||
| CVE-2026-57448 | 1 Mrblomblo | 1 Blombooru | 2026-10-29 | N/A |
| Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it server-side without meaningful destination validation. `proxy_image()` in `backend/app/routes/booru_import.py` only checks whether the value starts with http, then uses `get_client_for_url` or `requests.get` and streams the response. Private, loopback and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address. An authenticated administrator can enumerate internal services and access cloud instance metadata, potentially disclosing IAM credentials and crossing the application's intended cloud or network trust boundary. The reporter also observed a hanging recursive self-request. Administrator authentication remains a prerequisite; this is not an anonymous proxy. This issue is fixed in version 1.40.0. | ||||
| CVE-2026-42922 | 1 Frangoteam | 1 Frangoteam | 2026-10-29 | 9.8 Critical |
| A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-40063 | 1 Frangoteam | 1 Frangoteam | 2026-10-29 | 5.3 Medium |
| A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-105031 | 1 Apache | 1 Qpid Proton-c | 2026-10-29 | N/A |
| When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue. | ||||
| CVE-2026-105042 | 1 Apache | 1 Qpid Proton-c | 2026-10-29 | N/A |
| A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue. | ||||
| CVE-2026-114230 | 1 Apache | 1 Qpid Proton-c | 2026-10-29 | N/A |
| When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue. | ||||
| CVE-2026-115942 | 1 Apache | 1 Qpid Proton-c | 2026-10-29 | N/A |
| A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue. | ||||
| CVE-2026-94109 | 1 Openequella | 1 Openequella | 2026-10-29 | 8 High |
| openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet. | ||||