Export limit exceeded: 410586 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410586 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-101896 | 1 Angular | 2 Angular, Router | 2026-10-20 | N/A |
| Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0. | ||||
| CVE-2026-100406 | 2026-10-20 | N/A | ||
| dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5. | ||||
| CVE-2026-100236 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-10-20 | 8.6 High |
| A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write. | ||||
| CVE-2016-15060 | 1 Pcman | 1 Ftp Server | 2026-10-20 | 8.3 High |
| A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-8355 | 1 Ibm | 2 Contextforge-mcp-gateway, Contextforge Mcp Gateway | 2026-10-20 | N/A |
| IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters. | ||||
| CVE-2026-102985 | 2026-10-20 | 6.5 Medium | ||
| Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project administrator. ProjectMemberPreferenceEndpoint.patch separately trusts the member_id path value and lets a project member overwrite another member's preferences. These missing object-level authorization checks permit membership disruption and cross-member preference tampering. The vulnerability is fixed in 1.4.0. | ||||
| CVE-2026-12489 | 2026-10-20 | 6.5 Medium | ||
| An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device. | ||||
| CVE-2026-110668 | 1 Cemtan | 1 Sar2html | 2026-10-20 | 7.3 High |
| A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-55385 | 1 Invoiceshelf | 1 Invoiceshelf | 2026-10-20 | 6.8 Medium |
| InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0. | ||||
| CVE-2026-54701 | 2026-10-20 | N/A | ||
| Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30. | ||||
| CVE-2026-75753 | 1 Asus | 1 Router | 2026-10-20 | N/A |
| Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-17518 | 1 Asus | 1 Router | 2026-10-20 | N/A |
| Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information. | ||||
| CVE-2024-4412 | 1 Wso2 | 12 Identity Server, Wso2 Api Manager, Wso2 Carbon Identity Application Authentication Framework and 9 more | 2026-10-20 | 2.7 Low |
| The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations. | ||||
| CVE-2026-102438 | 1 Asus | 2 Armoury Crate, Armoury Crate Se | 2026-10-20 | N/A |
| An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-103043 | 2 Alexcorvi, Anchorme Project | 2 Anchorme, Anchorme | 2026-10-20 | 7.5 High |
| anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests. | ||||
| CVE-2026-81029 | 1 Open-metadata | 1 Openmetadata | 2026-10-20 | 8.1 High |
| OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer servlet later formats that stored value into a URL carrying the freshly issued JWT together with the account's email and name before sending the redirect. The OIDC and OAuth2 handler follows the same pattern with its own redirect parameter and the issued identity token. A request naming a destination the attacker controls therefore causes the server to deliver a valid token for whoever completes the login to that destination. Because the token authenticates API calls as that account, a user who follows such a link and authenticates hands over control of their account. Version 2.0.0 removes the caller-supplied callback parameter; no 1.x release validates it. | ||||
| CVE-2026-112392 | 1 Python-pillow | 1 Pillow | 2026-10-20 | 7.5 High |
| Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-109764 | 1 Mozilla | 1 Firefox | 2026-10-20 | 5.4 Medium |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-64758 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-10-20 | 7.8 High |
| The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination. | ||||
| CVE-2026-110601 | 1 Saitoha | 1 Libsixel | 2026-10-20 | 6.3 Medium |
| libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes. | ||||