Export limit exceeded: 396970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396970 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-57576 | 1 Plone | 2 Plone.app.contenttypes, Plone.app.dexterity | 2026-09-23 | 6.5 Medium |
| plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1. | ||||
| CVE-2026-79906 | 1 Adobe | 1 Substance 3d Modeler | 2026-09-23 | 7.8 High |
| Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-83962 | 1 Adobe | 1 Substance 3d Modeler | 2026-09-23 | 7.8 High |
| Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-81657 | 1 Ibm | 1 Guardium Data Protection | 2026-09-23 | 9.8 Critical |
| IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | ||||
| CVE-2026-65178 | 1 Nvidia | 1 Nemo Speech | 2026-09-23 | 7.8 High |
| NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure. | ||||
| CVE-2024-1300 | 1 Redhat | 21 A Mq Clients, Amq Broker, Amq Streams and 18 more | 2026-09-23 | 5.4 Medium |
| A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error. | ||||
| CVE-2024-1023 | 1 Redhat | 21 A Mq Clients, Amq Broker, Amq Streams and 18 more | 2026-09-23 | 6.5 Medium |
| A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak. | ||||
| CVE-2026-96258 | 1 Onsite Internet Gmbh | 1 Auktion Ng Auktionssoftware | 2026-09-23 | 4.3 Medium |
| A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-95929 | 1 Iflytek | 1 Astron-agent | 2026-09-23 | 6.3 Medium |
| A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component. | ||||
| CVE-2026-93749 | 1 7rulnik | 1 Source-map-js | 2026-09-23 | 7.5 High |
| source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests. | ||||
| CVE-2026-95924 | 1 Sourcecodester | 1 Online Reviewer Management System | 2026-09-23 | 7.3 High |
| A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-96272 | 1 Clip-bucket | 1 Clipbucket | 2026-09-23 | 7.5 High |
| ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover. | ||||
| CVE-2026-84709 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 4.9 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration count, output size, or execution time. An authenticated superuser can submit a credential type whose injector contains deeply nested loops or large string operations, consuming CPU and wall-clock time in the web worker until it is killed by the request timeout; issuing enough concurrent requests places all web workers into a kill-and-respawn loop, making the Controller API and UI unavailable for the duration of the attack. Additionally, certain template constructs raise exception types that the validator does not handle, resulting in an unhandled server error (HTTP 500) instead of a clean validation error. The rendering sandbox prevents code execution, so there is no confidentiality or integrity impact. | ||||
| CVE-2026-84707 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 6.5 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The host_filter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relations it traverses. Because job event and ad-hoc command output fields are not on that blocklist, an authenticated user holding only the Read role on an inventory can construct filters that traverse into the output of jobs they have no permission to view and use the returned host count as a boolean oracle. Using regular-expression lookups, the attacker can extract, character by character, the output (which routinely contains plaintext credentials, tokens, and command results) of jobs and ad-hoc commands belonging to other organizations, resulting in cross-tenant disclosure of job output | ||||
| CVE-2026-84686 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 7.6 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a password subfield after the notification type is changed to one that does not define that subfield. A user with administrative access to a single notification template, but without any wider privilege, can switch the template type to reveal the stored ciphertext, replant that ciphertext into a webhook password field pointing at a server they control, and trigger a test notification. The controller decrypts the replayed ciphertext to the original plaintext and sends it to the attacker's server in an HTTP Basic authorization header, allowing recovery of Slack, PagerDuty, Twilio, AWS SNS, and Grafana credentials the administrator was only permitted to use, not read. | ||||
| CVE-2026-84644 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 7.4 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Thycotic Secret Server external credential plugin passes a user-supplied server URL to its SDK without validating the scheme, host, or IP range, and the plugin backend is executed synchronously within the automation controller web process. Using the external credential test endpoint, a user who holds only the use role on such a credential can override the stored server URL with an arbitrary internal address, causing the control plane to issue requests to internal services. Although the response is a generic error, response timing reveals whether internal hosts and ports are reachable, enabling internal network reconnaissance and a blind request-forgery primitive from the control plane, and each request can hold a web worker, affecting availability. | ||||
| CVE-2026-84475 | 2026-09-23 | 7.7 High | ||
| automation-controller: InventorySource.source_vars lacks prevent_search, enabling zero-privilege cross-tenant extraction of inline inventory-plugin credentials via the credential_types FieldLookupBackend count-oracle | ||||
| CVE-2026-84692 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.5 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the incoming one, and a node can be created without a unified job template. An authenticated user who holds admin permission on a single workflow job template can create an empty node and then patch it to reference any job template, project, inventory source, system job, or workflow on the platform -- including ones in other organizations that they cannot otherwise read or launch. Running their own workflow then executes the victim template with the victim's attached credentials, inventory and project, resulting in cross-organization privilege escalation to arbitrary automation execution. The patch response also discloses the victim template's name and description. | ||||
| CVE-2026-84689 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.5 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job -- writable and does not include it in the permission validation performed for the other node fields. An authenticated user with permission to execute a single job template can submit a bulk job launch whose node references the identifier of any unified job in any organization, including jobs they cannot access. The node then exposes that job's metadata, and cancelling the attacker's workflow cancels the referenced job through the workflow cancellation cascade, without any per-job authorization check. Repeated, this allows a low-privileged user to cancel running jobs, project and inventory syncs, ad hoc commands, and system jobs across all organizations, denying automation service platform-wide. | ||||
| CVE-2026-84684 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 9.6 Critical |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the input_inventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that they hold use permission on it, unlike instance group attachment on the same access class. An authenticated user who can administer a constructed inventory and has read-only visibility of an inventory in another organization -- for example an organization or system auditor -- can attach that foreign inventory as an input. On synchronization the controller clones every host and host variable, including secrets, into the attacker's inventory, and because the attacker administers the constructed inventory they can run ad hoc commands against the cloned hosts, resulting in cross-tenant disclosure of inventory data and secrets and code execution against another tenant's managed hosts. | ||||