Export limit exceeded: 424911 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424911 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125652 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-10 | 6.8 Medium |
| A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier. | ||||
| CVE-2026-122014 | 1 Npc-worldwide | 1 Npcpy | 2026-11-10 | 6.3 Medium |
| A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-84229 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 6.5 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests. | ||||
| CVE-2026-109830 | 2026-11-10 | 7.3 High | ||
| A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device. | ||||
| CVE-2026-84228 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 3.1 Low |
| IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | ||||
| CVE-2026-84030 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 5.6 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-58965 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-121085 | 1 Google | 1 Chrome | 2026-11-10 | 4.3 Medium |
| Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-97402 | 2026-11-10 | N/A | ||
| In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled. | ||||
| CVE-2026-81542 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 6.4 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. | ||||
| CVE-2026-80435 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 5 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. | ||||
| CVE-2026-18484 | 1 Ibm | 2 Contextforge, Contextforge Mcp Gateway | 2026-11-10 | 6.5 Medium |
| IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions. | ||||
| CVE-2026-102715 | 1 Eclipse | 1 Threadx Netx Duo | 2026-11-10 | N/A |
| In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records. | ||||
| CVE-2026-112191 | 2026-11-10 | N/A | ||
| In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3. | ||||
| CVE-2026-121096 | 1 Google | 1 Chrome | 2026-11-10 | 5.5 Medium |
| Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-86336 | 2026-11-10 | N/A | ||
| Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-86531 | 2026-11-10 | N/A | ||
| The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions. | ||||
| CVE-2026-87758 | 2026-11-10 | N/A | ||
| The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-97849 | 2026-11-10 | N/A | ||
| The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-97867 | 2026-11-10 | N/A | ||
| The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||