Export limit exceeded: 417460 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417460 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118030 | 2 Red Hat, Redhat | 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more | 2026-10-30 | 4.2 Medium |
| A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously. | ||||
| CVE-2026-117028 | 1 Yungifez | 1 Skuul School Management System | 2026-10-30 | N/A |
| Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization. | ||||
| CVE-2026-117350 | 1 Bitcoin | 1 Bitcoin Core | 2026-10-30 | N/A |
| Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. | ||||
| CVE-2026-114690 | 3 Gcc, Red Hat, Redhat | 7 Gcc, Enterprise Linux, Enterprise Linux and 4 more | 2026-10-30 | 6.2 Medium |
| A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS). | ||||
| CVE-2026-119424 | 1 Opnsense | 2 Core, Opnsense | 2026-10-30 | 6.8 Medium |
| OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons. | ||||
| CVE-2026-77884 | 1 Brain Trust | 1 Gallery - Private Photo Vault | 2026-10-30 | N/A |
| Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage. | ||||
| CVE-2012-5562 | 1 Redhat | 2 Network Proxy, Satellite | 2026-10-30 | 8.6 High |
| A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are exposed to unauthorized parties. | ||||
| CVE-2013-2056 | 1 Redhat | 2 Network Satellite, Satellite | 2026-10-30 | 7.5 High |
| A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication process and obtain sensitive channel content. This vulnerability leads to unauthorized information disclosure. | ||||
| CVE-2006-4339 | 2 Openssl, Redhat | 6 Openssl, Enterprise Linux, Jboss Core Services and 3 more | 2026-10-30 | 9.1 Critical |
| A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms. | ||||
| CVE-2026-37171 | 1 Supertokens | 1 Supertokens | 2026-10-30 | 5.9 Medium |
| A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. | ||||
| CVE-2025-66208 | 2 Collabora, Collaboraoffice | 2 Collabora Online - Built-in Code Server, Online | 2026-10-30 | 9.8 Critical |
| Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702. | ||||
| CVE-2026-110447 | 1 Collabora | 1 Collabora Online - Built-in Code Server | 2026-10-30 | 9.8 Critical |
| Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. | ||||
| CVE-2026-76027 | 1 Google | 1 Chrome | 2026-10-30 | 4.3 Medium |
| Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-119262 | 1 Google | 1 Chrome | 2026-10-30 | 8.8 High |
| Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-119263 | 1 Google | 1 Chrome | 2026-10-30 | 9.6 Critical |
| Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-119265 | 1 Google | 1 Chrome | 2026-10-30 | 8.8 High |
| Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-119266 | 1 Google | 1 Chrome | 2026-10-30 | 8.8 High |
| Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-118072 | 2026-10-30 | 5.4 Medium | ||
| The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders. | ||||
| CVE-2026-119569 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-30 | 5.3 Medium |
| Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart. | ||||
| CVE-2026-119600 | 1 Simsong | 1 Tcpflow | 2026-10-30 | 4.8 Medium |
| tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow. | ||||