Export limit exceeded: 107128 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107128 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116819 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 8.5 High |
| OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems. | ||||
| CVE-2026-116811 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 8.8 High |
| OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process. | ||||
| CVE-2026-116808 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 7.2 High |
| OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions. | ||||
| CVE-2026-52356 | 1 D-link | 1 Dap-1160l | 2026-10-26 | 8.8 High |
| An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters. | ||||
| CVE-2026-115728 | 1 Hapijs | 1 Content | 2026-10-26 | 7.5 High |
| @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop. | ||||
| CVE-2026-94064 | 1 Buddhathemes | 1 Neo | Barber Shop Wordpress Theme | 2026-10-26 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5. | ||||
| CVE-2026-83535 | 1 Redhat | 2 Openstack, Openstack Platform | 2026-10-26 | 7.4 High |
| A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure. | ||||
| CVE-2026-103967 | 1 Adobe | 2 Adobe Framemaker 2022, Adobe Framemaker 2026 | 2026-10-26 | 7.8 High |
| Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-106625 | 1 Adobe | 2 Adobe Framemaker 2022, Adobe Framemaker 2026 | 2026-10-26 | 7.8 High |
| Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103966 | 1 Adobe | 2 Adobe Framemaker 2022, Adobe Framemaker 2026 | 2026-10-26 | 7.8 High |
| Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-70161 | 1 Microsoft | 4 .net, Microsoft Visual Studio 2022 Version 17.14, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-26 | 7.3 High |
| Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85363 | 1 Microsoft | 5 .net, .net Framework, Microsoft Visual Studio 2022 Version 17.14 and 2 more | 2026-10-26 | 8.8 High |
| Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-96235 | 1 Microsoft | 4 .net, Microsoft Visual Studio 2022 Version 17.14, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-26 | 8.8 High |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96237 | 1 Microsoft | 4 .net, Microsoft Visual Studio 2022 Version 17.14, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-26 | 7.5 High |
| Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-94453 | 1 Libreswan | 1 Libreswan | 2026-10-26 | 7.5 High |
| Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected. | ||||
| CVE-2026-77206 | 1 Libreswan | 1 Libreswan | 2026-10-26 | 7.5 High |
| Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service. | ||||
| CVE-2026-77207 | 1 Libreswan | 1 Libreswan | 2026-10-26 | 7.5 High |
| Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service. | ||||
| CVE-2026-116576 | 1 Sebhildebrandt | 1 Systeminformation | 2026-10-26 | 7.8 High |
| systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16. | ||||
| CVE-2026-16753 | 1 Lowcoder | 1 Lowcoder | 2026-10-26 | 8.8 High |
| Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier. | ||||
| CVE-2026-110616 | 1 Nullclaw | 1 Nullhub | 2026-10-26 | 8.1 High |
| NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers. | ||||