Export limit exceeded: 12049 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12049 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93892 | 1 Ibm | 1 Tririga Application Platform | 2026-10-13 | 8.1 High |
| IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response. | ||||
| CVE-2026-17487 | 1 Ibm | 1 I | 2026-10-13 | 5.3 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process. | ||||
| CVE-2026-17484 | 1 Ibm | 1 I | 2026-10-13 | 5.3 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control. | ||||
| CVE-2026-108861 | 1 Erpipe-org | 1 Odoo Mcp | 2026-10-13 | 4.3 Medium |
| Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted. | ||||
| CVE-2026-108578 | 1 Neterbit | 2 Nw-431f, Nw-431f Router | 2026-10-13 | 5.3 Medium |
| A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-109958 | 1 Espocrm | 1 Espocrm | 2026-10-13 | 4.3 Medium |
| EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the emailAddress field. | ||||
| CVE-2026-109948 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 4.3 Medium |
| FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing smartcard_pack_transmit_return to serialize up to 66,560 uninitialized heap bytes. | ||||
| CVE-2026-103417 | 1 Mozilla | 1 Firefox For Ios | 2026-10-13 | 5.5 Medium |
| Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1. | ||||
| CVE-2026-89309 | 2026-10-13 | N/A | ||
| Vulnerability in tbc. This issue affects tbc: before 1. | ||||
| CVE-2026-21127 | 1 Samsung Mobile | 1 Samsung Account | 2026-10-13 | N/A |
| Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. | ||||
| CVE-2026-21133 | 1 Samsung Mobile | 1 Samsung Flow | 2026-10-13 | N/A |
| Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. | ||||
| CVE-2026-89097 | 2026-10-13 | 4.3 Medium | ||
| The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins. | ||||
| CVE-2026-77364 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-13 | 6.5 Medium |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths. | ||||
| CVE-2026-85966 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.7 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources. | ||||
| CVE-2026-108937 | 1 Code-projects | 1 Online Ticket Reservation System | 2026-10-12 | 5.3 Medium |
| A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-109341 | 1 Surrealdb | 1 Surrealdb | 2026-10-12 | 7.1 High |
| SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle. | ||||
| CVE-2026-109292 | 1 Openwebui | 1 Open Webui | 2026-10-12 | 6.8 Medium |
| Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators. | ||||
| CVE-2026-21135 | 1 Samsung Mobile | 1 Samsung Internet | 2026-10-12 | N/A |
| Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. | ||||
| CVE-2026-108810 | 1 Tsi-coop | 1 Tsi-dpdp-cms | 2026-10-12 | 5.3 Medium |
| A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-18496 | 2026-10-11 | 5.3 Medium | ||
| The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings. | ||||