Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425803 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87907 | 1 Wordpress-extensions | 1 Rox Appointment Booking | 2026-11-13 | 5.3 Medium |
| The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category. | ||||
| CVE-2026-112318 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-13 | 6.5 Medium |
| The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code. | ||||
| CVE-2026-112316 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-13 | 6.5 Medium |
| xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure. | ||||
| CVE-2026-87959 | 1 Wordpress-extensions | 1 Wpbot | 2026-11-13 | 5.4 Medium |
| The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests. | ||||
| CVE-2026-88910 | 1 Wordpress-extensions | 1 Kboard | 2026-11-13 | 5.3 Medium |
| The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers. | ||||
| CVE-2026-112315 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-13 | 5.3 Medium |
| The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages. | ||||
| CVE-2026-10609 | 1 Redhat | 3 Cluster Logging Operator, Logging, Logging Subsystem For Red Hat Openshift | 2026-11-13 | 6.8 Medium |
| A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges. | ||||
| CVE-2026-124628 | 1 Octopus | 1 Octopus Server | 2026-11-13 | N/A |
| In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged. | ||||
| CVE-2026-92615 | 1 Redhat | 4 Acm, Advanced Cluster Management For Kubernetes, Edge Manager and 1 more | 2026-11-13 | 6.6 Medium |
| A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol("https", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. This race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations. | ||||
| CVE-2026-13732 | 1 Redhat | 13 Cost Management On Premise, Enterprise Linux, Enterprise Linux Eus and 10 more | 2026-11-13 | 7 High |
| A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process. | ||||
| CVE-2026-124627 | 1 Octopus | 1 Octopus Server | 2026-11-13 | N/A |
| In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams. | ||||
| CVE-2026-59624 | 1 Google | 1 Android | 2026-11-13 | 4.0 Medium |
| In multiple locations, there is a possible way to trigger an out of bounds read via direct memory access in video decoder firmware due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-95400 | 1 Google | 1 Android | 2026-11-13 | 8.4 High |
| In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-95402 | 1 Google | 1 Android | 2026-11-13 | 7.8 High |
| In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-95404 | 1 Google | 1 Android | 2026-11-13 | 6.7 Medium |
| In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-125880 | 1 N-able | 1 N-central | 2026-11-13 | N/A |
| Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1. | ||||
| CVE-2026-123790 | 2026-11-13 | N/A | ||
| ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process. | ||||
| CVE-2026-125455 | 2 Bold-themes, Wordpress-extensions | 2 Bold Page Builder, Bold Page Builder | 2026-11-13 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11. | ||||
| CVE-2026-127101 | 3 Red Hat, Redhat, Sssd | 6 Enterprise Linux, Enterprise Linux, Openshift and 3 more | 2026-11-13 | 5.5 Medium |
| A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service. | ||||
| CVE-2026-120221 | 1 Frrouting | 1 Frrouting | 2026-11-13 | N/A |
| In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected. | ||||