Export limit exceeded: 16424 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16424 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66986 | 2026-11-06 | 3.3 Low | ||
| HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-123677 | 2 201206030, Xxyopen | 2 Novel, Novel | 2026-11-06 | 4.3 Medium |
| A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue. | ||||
| CVE-2026-83494 | 2 Red Hat, Redhat | 2 Red Hat Openshift Ai (rhoai), Openshift Ai | 2026-11-06 | N/A |
| A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition. | ||||
| CVE-2026-112550 | 1 Apple | 1 Macos | 2026-11-06 | 5.5 Medium |
| A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause a denial-of-service. | ||||
| CVE-2024-8354 | 2 Qemu, Redhat | 4 Qemu, Advanced Virtualization, Enterprise Linux and 1 more | 2026-11-06 | 5.5 Medium |
| A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition. | ||||
| CVE-2026-64860 | 2026-11-06 | 6.5 Medium | ||
| ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an `ESP-IDF` device using `espressif/mdns` with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2. | ||||
| CVE-2026-54442 | 2 Nationalsecurityagency, Nsa | 2 Emissary, Emissary | 2026-11-06 | 4.8 Medium |
| Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0. | ||||
| CVE-2026-78188 | 1 Perl | 1 Webdyne | 2026-11-06 | 5.4 Medium |
| WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it. | ||||
| CVE-2026-118187 | 2026-11-06 | 2.7 Low | ||
| The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content. | ||||
| CVE-2026-123291 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 4.3 Medium |
| In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook | ||||
| CVE-2026-89101 | 2 Wordpress-extensions, Wpeverest | 2 Everest Forms, Everest Forms | 2026-11-06 | 6.5 Medium |
| The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership. | ||||
| CVE-2026-122266 | 1 Aws | 2 Amazon-vpc-cni-k8s, Aws-network-policy-agent | 2026-11-06 | 8.7 High |
| Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7). | ||||
| CVE-2026-90967 | 2026-11-06 | 4.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details. | ||||
| CVE-2026-86442 | 2026-11-06 | 8.2 High | ||
| The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events. | ||||
| CVE-2026-16304 | 2026-11-06 | 8.1 High | ||
| The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled. | ||||
| CVE-2026-120749 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-06 | 6.2 Medium |
| A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service. | ||||
| CVE-2026-123329 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 5.4 Medium |
| In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions | ||||
| CVE-2026-121636 | 2026-11-06 | 5.3 Medium | ||
| The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment. | ||||
| CVE-2026-84155 | 1 Ericsson | 1 Codechecker | 2026-11-06 | N/A |
| CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token from their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out. | ||||
| CVE-2026-120474 | 1 Undici | 1 Undici | 2026-11-06 | 6.5 Medium |
| undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. | ||||