Export limit exceeded: 424002 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424002 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55236 | 1 Langchain-ai | 1 Langgraph-api | 2026-11-10 | 5.9 Medium |
| langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cron creation. In deployments with custom resource handlers that register only assistants.read, omit an assistants.search handler, and have no global fallback handler, no applicable handler supplies an owner filter, allowing a low-privileged user to reference another user's private assistant through POST /runs or POST /threads/{thread_id}/runs. The run-creation response can disclose the private assistant's metadata, config, and context, and the run can execute using that assistant's configuration. Deployments without custom authorization handlers, or with an equivalent owner filter applied through a global handler or across all assistant events, are not affected. This issue is fixed in version 0.10.0. | ||||
| CVE-2026-55235 | 1 Langchain-ai | 1 Langgraph-api | 2026-11-10 | 5.9 Medium |
| langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal without applying the authentication context used for external requests. In deployments that rely on per-user authorization to separate threads and runs, an authenticated user can direct a webhook to the server's own thread and run routes, allowing creation of a run on or modification of another user's thread and limited incorporation of the targeted thread's metadata into the created run record. The affected path requires webhook targets and per-user authorization boundaries; deployments that deliberately re-enable loopback delivery should restrict it to controlled same-process routes because those webhooks remain unauthenticated. This issue is fixed in version 0.10.0. | ||||
| CVE-2026-90994 | 3 Red Hat, Redhat, Sssd | 6 Enterprise Linux, Enterprise Linux, Openshift and 3 more | 2026-11-10 | 4 Medium |
| A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service. | ||||
| CVE-2026-90995 | 4 Fedoraproject, Red Hat, Redhat and 1 more | 7 Sssd, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-10 | 5.5 Medium |
| A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services. | ||||
| CVE-2026-90996 | 4 Fedoraproject, Red Hat, Redhat and 1 more | 7 Sssd, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-10 | 4 Medium |
| A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder. | ||||
| CVE-2026-73449 | 1 Arista | 1 Eos | 2026-11-10 | 5.9 Medium |
| On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks. | ||||
| CVE-2026-77191 | 1 Arista | 1 Eos | 2026-11-10 | 2.6 Low |
| An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL. | ||||
| CVE-2026-91199 | 1 Refly-ai | 1 Refly | 2026-11-10 | 5 Medium |
| Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources. | ||||
| CVE-2026-75943 | 1 Arista | 1 Eos | 2026-11-10 | 2.6 Low |
| A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement. | ||||
| CVE-2026-75944 | 1 Arista | 1 Eos | 2026-11-10 | 2.6 Low |
| A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect. | ||||
| CVE-2026-75945 | 1 Arista | 1 Eos | 2026-11-10 | 2.6 Low |
| A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. | ||||
| CVE-2026-88617 | 1 1024-lab | 1 Smart-admin | 2026-11-10 | 9.8 Critical |
| SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges. | ||||
| CVE-2026-91772 | 1 Halo | 1 Halo | 2026-11-10 | 6.1 Medium |
| Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships. | ||||
| CVE-2026-91778 | 1 Octopus | 1 Octopus Server | 2026-11-10 | N/A |
| In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation. | ||||
| CVE-2026-91786 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Els | 2026-11-10 | 6.1 Medium |
| A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory. | ||||
| CVE-2026-91926 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-11-10 | 3.7 Low |
| A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service. | ||||
| CVE-2026-85013 | 2 Red Hat, Redhat | 6 Enterprise Linux, Enterprise Linux, Hardened Images and 3 more | 2026-11-10 | 7.3 High |
| A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability. | ||||
| CVE-2026-79705 | 2 Red Hat, Redhat | 15 Enterprise Linux, Red Hat Quay 3, Ansible Automation Platform and 12 more | 2026-11-10 | 4.5 Medium |
| A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected. | ||||
| CVE-2026-79699 | 2 Red Hat, Redhat | 15 Enterprise Linux, Red Hat Quay 3, Ansible Automation Platform and 12 more | 2026-11-10 | 4.4 Medium |
| A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer. | ||||
| CVE-2024-58385 | 1 Yonyou | 1 U8 Crm | 2026-11-10 | 9.8 Critical |
| Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13. | ||||