Export limit exceeded: 412384 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412384 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-60038 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||
| CVE-2026-60037 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||
| CVE-2026-60036 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||
| CVE-2026-60035 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||
| CVE-2026-107364 | 2026-11-10 | 7.5 High | ||
| In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate. | ||||
| CVE-2026-113963 | 1 Apple | 3 Ios And Ipados, Visionos, Watchos | 2026-11-10 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data. | ||||
| CVE-2026-113965 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-10 | 5.4 Medium |
| This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction. | ||||
| CVE-2026-113971 | 1 Apple | 1 Ios And Ipados | 2026-11-10 | 3.5 Low |
| This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen. | ||||
| CVE-2026-124598 | 2 Geovision, Geovision Inc. | 2 Gv-face, Gv-face | 2026-11-10 | 7.5 High |
| An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-124599 | 2 Geovision, Geovision Inc. | 2 Gv-face, Gv-face | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124600 | 2 Geovision, Geovision Inc. | 2 Gv-face, Gv-face | 2026-11-10 | N/A |
| GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic. | ||||
| CVE-2026-124604 | 2 Geovision, Geovision Inc. | 2 Gv-cloud, Gv-cloud | 2026-11-10 | 6.2 Medium |
| The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations. | ||||
| CVE-2026-124603 | 2 Geovision, Geovision Inc. | 2 Gv-cloud, Gv-cloud | 2026-11-10 | 6.2 Medium |
| An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-124601 | 2 Geovision, Geovision Inc. | 2 Gv-access, Gv-access | 2026-11-10 | 6.2 Medium |
| An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-107246 | 2026-11-10 | N/A | ||
| The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root. | ||||
| CVE-2026-50000 | 1 Freedomofpress | 1 Securedrop | 2026-11-10 | 5 Medium |
| SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0. | ||||
| CVE-2026-119339 | 1 Tesseract-ocr | 1 Tesseract Ocr | 2026-11-10 | 5.5 Medium |
| Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4. | ||||
| CVE-2026-116769 | 1 Absolute | 1 Secure Access | 2026-11-10 | N/A |
| CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server. | ||||
| CVE-2026-89292 | 1 Eclipse | 1 Eclipse Mnestix | 2026-11-10 | N/A |
| In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures. | ||||
| CVE-2026-89295 | 1 Eclipse | 1 Eclipse Mnestix | 2026-11-10 | 7.5 High |
| In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository. | ||||