Export limit exceeded: 409342 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409342 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110226 | 1 Webkul | 1 Qloapps | 2026-10-16 | 5.4 Medium |
| QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels. | ||||
| CVE-2026-110221 | 1 Webkul | 1 Qloapps | 2026-10-16 | 5.4 Medium |
| QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session. | ||||
| CVE-2026-110113 | 2 Publiccms, Sanluan | 2 Publiccms, Publiccms | 2026-10-16 | 4.3 Medium |
| PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified. | ||||
| CVE-2026-110106 | 1 Dromara | 1 Ruoyi-vue-plus | 2026-10-16 | 4.2 Medium |
| RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login. | ||||
| CVE-2026-108376 | 2026-10-16 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar. | ||||
| CVE-2026-101985 | 1 Juniper Networks | 1 Junos Os Evolved | 2026-10-16 | 6.5 Medium |
| A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service. | ||||
| CVE-2026-101986 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 9.8 Critical |
| An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. | ||||
| CVE-2026-101991 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 3.1 Low |
| An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a session with the traffic-engineering address family enabled. | ||||
| CVE-2026-101989 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 6.5 Medium |
| A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a compromised LDP neighbor to cause an rpd crash via a crafted LDP message. | ||||
| CVE-2026-101988 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 6.5 Medium |
| A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session. | ||||
| CVE-2026-101987 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 6.5 Medium |
| An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a denial of service by sending a specific IS-IS SRv6 packet when SRv6 and Flexible Algorithm are enabled. | ||||
| CVE-2026-101984 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 6.5 Medium |
| A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. | ||||
| CVE-2026-101983 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-16 | 9.8 Critical |
| A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. | ||||
| CVE-2026-89088 | 1 Redhat | 1 Enterprise Linux | 2026-10-16 | 5.5 Medium |
| A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS). | ||||
| CVE-2026-89085 | 1 Redhat | 1 Enterprise Linux | 2026-10-16 | 6.6 Medium |
| A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption. | ||||
| CVE-2026-98397 | 1 Linux | 1 Linux Kernel | 2026-10-16 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim. Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset(). | ||||
| CVE-2026-102479 | 2026-10-16 | N/A | ||
| In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core. | ||||
| CVE-2026-104586 | 2026-10-16 | N/A | ||
| AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi. | ||||
| CVE-2026-103224 | 2026-10-16 | 5.9 Medium | ||
| In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mysql-client. | ||||
| CVE-2026-83864 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-16 | 5.5 Medium |
| Improper access control in Windows NTFS allows an authorized attacker to disclose information locally. | ||||