Export limit exceeded: 397982 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (397982 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92164 | 1 Streamlink | 1 Streamlink | 2026-09-23 | 6.5 Medium |
| Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0. | ||||
| CVE-2026-18772 | 2 Samsung, Samsung Open Source | 2 Rlottie, Rlottie | 2026-09-23 | 6.5 Medium |
| Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. | ||||
| CVE-2026-10032 | 2 A2ui-project, Google | 2 A2ui, A2ui\/web Core | 2026-09-23 | 6.1 Medium |
| The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default. | ||||
| CVE-2026-0163 | 1 Google | 1 Android | 2026-09-23 | 9.8 Critical |
| In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-17601 | 1 Sonatype | 2 Nexus Repository Manager, Nexus Repository Manager 3 | 2026-09-23 | 7.2 High |
| A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment. | ||||
| CVE-2026-56818 | 1 Netty | 1 Netty | 2026-09-23 | 6.5 Medium |
| Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. | ||||
| CVE-2026-26825 | 2 Libxls, Libxls Project | 2 Libxls, Libxls | 2026-09-23 | 5.3 Medium |
| A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure. | ||||
| CVE-2026-26824 | 2 Libxls, Libxls Project | 2 Libxls, Libxls | 2026-09-23 | 6.5 Medium |
| libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file | ||||
| CVE-2026-47116 | 1 Ltsecurity | 1 Ltk3500sf | 2026-09-23 | 9.8 Critical |
| LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually. | ||||
| CVE-2026-19517 | 2 Samsung, Samsung Open Source | 2 Rlottie, Rlottie | 2026-09-23 | 6.5 Medium |
| Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation. | ||||
| CVE-2026-19518 | 2 Samsung, Samsung Open Source | 2 Rlottie, Rlottie | 2026-09-23 | 6.5 Medium |
| Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. | ||||
| CVE-2026-59781 | 1 Zabbix | 1 Zabbix | 2026-09-23 | 7.8 High |
| When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios. | ||||
| CVE-2026-23938 | 1 Zabbix | 1 Zabbix | 2026-09-23 | 4.9 Medium |
| An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. | ||||
| CVE-2026-73507 | 1 Netty | 1 Netty | 2026-09-23 | 7.5 High |
| Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. | ||||
| CVE-2026-81352 | 1 Microsoft | 7 Web Media Extensions, Windows 10 21h2, Windows 10 22h2 and 4 more | 2026-09-23 | 8.8 High |
| Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-73508 | 1 Netty | 1 Netty | 2026-09-23 | 5.3 Medium |
| Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. | ||||
| CVE-2026-19438 | 1 Abb | 1 Mint Workbench | 2026-09-23 | 7.5 High |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I. This issue affects Mint Workbench I: through 5876. | ||||
| CVE-2026-95625 | 1 Tauri | 1 Tauri-plugin-updater | 2026-09-23 | 5.9 Medium |
| The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key. | ||||
| CVE-2026-78442 | 1 Microsoft | 4 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Sql Server 2017 and 1 more | 2026-09-23 | 8.8 High |
| Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-80444 | 1 Abis Technology | 1 Avesis | 2026-09-23 | 5.4 Medium |
| URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351. | ||||