Export limit exceeded: 415310 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415310 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109666 | 1 Frappe | 1 Erpnext | 2026-10-12 | 6.5 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits. | ||||
| CVE-2026-85976 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-12 | 5.4 Medium |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling. | ||||
| CVE-2026-97062 | 1 Webkul | 1 Aureus Erp | 2026-10-12 | 5.4 Medium |
| Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration. | ||||
| CVE-2026-58462 | 2026-10-12 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-18255 | 1 Redhat | 2 Quay, Quay 3 | 2026-10-12 | 7.2 High |
| A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account. | ||||
| CVE-2026-21114 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | ||||
| CVE-2026-21122 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | ||||
| CVE-2026-107655 | 2 Cups, Redhat | 3 Cups, Enterprise Linux, Hummingbird | 2026-10-12 | 4 Medium |
| A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services. | ||||
| CVE-2026-18382 | 2 Red Hat, Redhat | 3 Cost Management Metrics Operator, Cost Management, Cost Management Metrics Operator | 2026-10-12 | 6.8 Medium |
| A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials. | ||||
| CVE-2026-13201 | 2 Kubevirt, Redhat | 3 Kubevirt, Container Native Virtualization, Openshift Virtualization | 2026-10-12 | 7.3 High |
| A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths. | ||||
| CVE-2026-18381 | 2 Red Hat, Redhat | 3 Cost Management Metrics Operator, Cost Management, Cost Management Metrics Operator | 2026-10-12 | 7.6 High |
| A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token. | ||||
| CVE-2026-18378 | 2 Red Hat, Redhat | 3 Cost Management Metrics Operator, Cost Management, Cost Management Metrics Operator | 2026-10-12 | 7.6 High |
| A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token. | ||||
| CVE-2026-108929 | 1 Netcore | 1 Nr268 | 2026-10-12 | 9.9 Critical |
| A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely. | ||||
| CVE-2024-33396 | 1 Karmada-io | 1 Karmada | 2026-10-12 | 8.4 High |
| An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution. | ||||
| CVE-2026-97058 | 1 Alexei | 1 Sprintf-js | 2026-10-12 | 5.3 Medium |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2025-6021 | 2 Redhat, Xmlsoft | 30 Discovery, Enterprise Linux, Enterprise Linux Eus and 27 more | 2026-10-12 | 7.5 High |
| A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. | ||||
| CVE-2025-49795 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Jboss Core Services | 2026-10-12 | 7.5 High |
| A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. | ||||
| CVE-2025-49794 | 1 Redhat | 16 Cert Manager, Enterprise Linux, Hummingbird and 13 more | 2026-10-12 | 9.1 Critical |
| A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. | ||||
| CVE-2021-48009 | 2026-10-12 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-108924 | 1 Getkirby | 1 Kirby | 2026-10-12 | 4.3 Medium |
| A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component. | ||||