Export limit exceeded: 410862 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410862 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96230 | 1 Microsoft | 3 Microsoft.aspnetcore.components.webassembly.server, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 8.8 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96233 | 1 Microsoft | 2 .net, .net Framework | 2026-10-19 | 7.5 High |
| Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96225 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.8 High |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96231 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.8 High |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70007 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-19 | 8.8 High |
| Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96236 | 1 Microsoft | 3 Asp.net Core, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.5 High |
| Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-70165 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 6.7 Medium |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-110673 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-19 | N/A |
| Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth. | ||||
| CVE-2026-112893 | 1 Python-pillow | 1 Pillow | 2026-10-19 | 7.5 High |
| Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112370 | 1 H3c | 2 Magic Nx15, Magic Nx15 Firmware | 2026-10-19 | 9.9 Critical |
| A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-96956 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-10-19 | 8 High |
| Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-52023 | 1 Kamailio | 1 Kamailio | 2026-10-19 | 7.5 High |
| An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree() | ||||
| CVE-2026-94668 | 2 Dimitri Grassi, Wordpress-extensions | 2 Salon Booking System, Salon Booking System | 2026-10-19 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5. | ||||
| CVE-2026-105964 | 1 Gitea | 1 Gitea | 2026-10-19 | 6.5 Medium |
| The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB. | ||||
| CVE-2026-108121 | 1 Koozali | 1 Sme Server | 2026-10-19 | N/A |
| Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts. | ||||
| CVE-2026-108120 | 1 Koozali | 1 Sme Server | 2026-10-19 | N/A |
| Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files. | ||||
| CVE-2026-108762 | 2 Apache, Apache Software Foundation | 2 Apache Kylin, Apache Kylin | 2026-10-19 | N/A |
| Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-108764 | 2 Apache, Apache Software Foundation | 2 Apache Kylin, Apache Kylin | 2026-10-19 | N/A |
| Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-108766 | 2 Apache, Apache Software Foundation | 2 Apache Kylin, Apache Kylin | 2026-10-19 | N/A |
| Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-108771 | 2 Apache, Apache Software Foundation | 2 Apache Kylin, Apache Kylin | 2026-10-19 | N/A |
| Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||