Export limit exceeded: 415433 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415433 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112322 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 7.5 High |
| clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries. | ||||
| CVE-2026-112321 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 7.5 High |
| The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures. | ||||
| CVE-2026-112320 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 7.5 High |
| The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts. | ||||
| CVE-2026-112319 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 6.5 Medium |
| The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding. | ||||
| CVE-2026-112318 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 6.5 Medium |
| The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code. | ||||
| CVE-2026-112317 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 5.3 Medium |
| krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures. | ||||
| CVE-2026-112316 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 6.5 Medium |
| xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure. | ||||
| CVE-2026-112315 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 5.3 Medium |
| The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages. | ||||
| CVE-2026-103963 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 2 more | 2026-11-12 | 7.5 High |
| A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS). | ||||
| CVE-2026-125434 | 2 Webful Creations, Wordpress-extensions | 2 Repairbuddy, Repairbuddy | 2026-11-12 | 5.4 Medium |
| Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235. | ||||
| CVE-2026-125680 | 2 Bold-themes, Wordpress-extensions | 2 Bold Page Builder, Bold Page Builder | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11. | ||||
| CVE-2026-124262 | 2 Igorfuna, Wordpress-extensions | 2 Ad Inserter, Ad Inserter | 2026-11-12 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19. | ||||
| CVE-2026-125776 | 2 Cozmoslabs, Wordpress-extensions | 2 Profile Builder, Profile Builder | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6. | ||||
| CVE-2026-125778 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 4.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-125436 | 2 Mamunur Rashid, Wordpress-extensions | 2 The Post Grid, The Post Grid | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9. | ||||
| CVE-2026-108472 | 2 Red Hat, Redhat | 7 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-11-12 | 7.8 High |
| A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed. | ||||
| CVE-2026-128067 | 2026-11-12 | N/A | ||
| Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-128066 | 2026-11-12 | N/A | ||
| Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO can therefore cause memory use quadratic in the input size. TIFF and some JPEG paths trigger parsing during Image.open(), while other formats are exposed when EXIF is requested, including through getexif() or ImageOps.exif_transpose(). The declared pixel dimensions do not bound this metadata allocation, so decompression-bomb checks do not prevent process memory exhaustion. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-128065 | 2026-11-12 | N/A | ||
| @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2. | ||||
| CVE-2026-14447 | 2026-11-12 | N/A | ||
| In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | ||||