Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82943 | 1 Rt-labs Ab | 1 Soem | 2026-11-10 | 6.5 Medium |
| SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory. | ||||
| CVE-2026-70379 | 1 Wolfvision | 1 Cynap Pro | 2026-11-10 | 6.5 Medium |
| When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled. | ||||
| CVE-2026-106971 | 1 Rybakit | 1 Msgpack.php | 2026-11-10 | 7.5 High |
| An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP | ||||
| CVE-2026-51831 | 1 Idrive | 1 Idrive Backup | 2026-11-10 | 7.8 High |
| An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component | ||||
| CVE-2026-119682 | 1 Manageengine | 1 Sharepoint Manager Plus | 2026-11-10 | N/A |
| An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506. | ||||
| CVE-2026-111487 | 1 Qt | 3 Qt, Qt3d, Qt Framework | 2026-11-10 | 7.8 High |
| An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. | ||||
| CVE-2026-60045 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 4.9 Medium |
| A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities. | ||||
| CVE-2026-60044 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.5 High |
| The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality. | ||||
| CVE-2026-60043 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 9.3 Critical |
| An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability. | ||||
| CVE-2026-60040 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.5 High |
| An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability. | ||||
| CVE-2026-60039 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||
| CVE-2026-60035 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||
| CVE-2026-107364 | 2026-11-10 | 7.5 High | ||
| In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate. | ||||
| CVE-2026-95741 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-10 | 8 High |
| A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system. | ||||
| CVE-2026-113971 | 1 Apple | 1 Ios And Ipados | 2026-11-10 | 3.5 Low |
| This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen. | ||||
| CVE-2026-124598 | 2 Geovision, Geovision Inc. | 2 Gv-face, Gv-face | 2026-11-10 | 7.5 High |
| An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-124599 | 2 Geovision, Geovision Inc. | 2 Gv-face, Gv-face | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124600 | 2 Geovision, Geovision Inc. | 2 Gv-face, Gv-face | 2026-11-10 | N/A |
| GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic. | ||||
| CVE-2026-124604 | 2 Geovision, Geovision Inc. | 2 Gv-cloud, Gv-cloud | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124603 | 2 Geovision, Geovision Inc. | 2 Gv-cloud, Gv-cloud | 2026-11-10 | 6.2 Medium |
| An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||