Export limit exceeded: 425070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425070 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-11376 | 1 Ibm | 1 Mq | 2026-11-12 | 8.8 High |
| IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values. | ||||
| CVE-2026-118500 | 2 Cool Plugins, Wordpress-extensions | 2 Cool Formkit Lite, Cool Formkit Lite | 2026-11-12 | 6.4 Medium |
| The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores " to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script. | ||||
| CVE-2026-122163 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.5 High |
| Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-122164 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 8 High |
| Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-122175 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-11-12 | 7 High |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-122179 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7 High |
| Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-122182 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7 High |
| Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-121744 | 1 Ashlar Vellum | 1 Cobalt | 2026-11-12 | N/A |
| Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28172. | ||||
| CVE-2026-122044 | 1 Philips | 1 Hue Bridge Pro | 2026-11-12 | N/A |
| Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-33086. | ||||
| CVE-2026-126197 | 2026-11-12 | 8.8 High | ||
| pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0. | ||||
| CVE-2026-119275 | 1 Akaunting | 1 Akaunting | 2026-11-12 | N/A |
| Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser. | ||||
| CVE-2026-125706 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-12 | 6.5 Medium |
| A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service. | ||||
| CVE-2026-125703 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-12 | 6.5 Medium |
| A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service. | ||||
| CVE-2026-126196 | 2026-11-12 | 8.1 High | ||
| pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0. | ||||
| CVE-2026-124702 | 2026-11-12 | 7.8 High | ||
| In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens. | ||||
| CVE-2026-96285 | 1 Apache | 1 Airflow | 2026-11-12 | 8.8 High |
| Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later. | ||||
| CVE-2026-19552 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-12 | N/A |
| When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked. | ||||
| CVE-2026-127109 | 2026-11-12 | N/A | ||
| A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted. | ||||
| CVE-2026-127030 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-12 | 7.5 High |
| A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS). | ||||
| CVE-2026-126082 | 2026-11-12 | N/A | ||
| This CVE is a duplicate of another CVE. | ||||