Export limit exceeded: 416336 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416336 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95717 | 1 Hpe | 1 Aos | 2026-10-26 | 5.5 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session. | ||||
| CVE-2026-95718 | 1 Hpe | 1 Aos | 2026-10-26 | 5.3 Medium |
| An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system. | ||||
| CVE-2026-95719 | 1 Hpe | 1 Aos | 2026-10-26 | 4.9 Medium |
| An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting normal operation of the affected device. | ||||
| CVE-2026-95720 | 1 Hpe | 1 Aos | 2026-10-26 | 4.4 Medium |
| A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations. | ||||
| CVE-2026-95721 | 1 Hpe | 1 Aos | 2026-10-26 | 3.3 Low |
| A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service. | ||||
| CVE-2026-112330 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop. | ||||
| CVE-2026-112331 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop. | ||||
| CVE-2026-112332 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop. | ||||
| CVE-2026-111594 | 1 Intersystems | 1 Iris For Health | 2026-10-26 | 8.1 High |
| InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | ||||
| CVE-2026-55981 | 1 Creative Labs | 1 Creative Sound Blaster Katana | 2026-10-26 | 9.6 Critical |
| A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. | ||||
| CVE-2026-63243 | 1 Creative Labs | 1 Creative Sound Blaster Katana | 2026-10-26 | 4.3 Medium |
| An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication. | ||||
| CVE-2026-63244 | 1 Wizlearn Technologies | 1 Learning Management System | 2026-10-26 | 9.8 Critical |
| An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform. | ||||
| CVE-2026-89312 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine. | ||||
| CVE-2026-89313 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found". | ||||
| CVE-2026-89314 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds. | ||||
| CVE-2026-89315 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names. | ||||
| CVE-2026-89316 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**. | ||||
| CVE-2026-89317 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were. | ||||
| CVE-2026-89318 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine. | ||||
| CVE-2026-89319 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error. | ||||