Export limit exceeded: 412313 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412313 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58975 | 1 Google | 1 Android | 2026-11-09 | 8.4 High |
| In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-77604 | 1 Vitali87 | 1 Code-graph-rag | 2026-11-09 | 7.5 High |
| Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345. | ||||
| CVE-2026-19706 | 1 Redhat | 3 Assisted Installer, Multicluster Engine, Openshift | 2026-11-09 | 8.3 High |
| During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window. | ||||
| CVE-2026-112322 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-09 | 7.5 High |
| clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries. | ||||
| CVE-2026-112321 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-09 | 7.5 High |
| The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures. | ||||
| CVE-2026-112316 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-09 | 6.5 Medium |
| xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure. | ||||
| CVE-2026-76166 | 1 Redhat | 7 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack, Jboss Enterprise Web Server and 4 more | 2026-11-09 | 4.3 Medium |
| A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected. | ||||
| CVE-2026-58976 | 1 Google | 1 Android | 2026-11-09 | 4 Medium |
| In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-115934 | 1 Craftcms | 1 Cms | 2026-11-09 | 9.8 Critical |
| An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database. * Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash. Update to the patched versions (4.18.9 and 5.11.2) to get the fix. If you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation. | ||||
| CVE-2026-58978 | 1 Google | 1 Android | 2026-11-09 | 6.8 Medium |
| In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58979 | 1 Google | 1 Android | 2026-11-09 | 8.4 High |
| In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-125075 | 1 Sourcecodester | 1 Smart Attendance System With Qr Code Scanner | 2026-11-09 | 7.3 High |
| A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-12977 | 1 Redhat | 4 Jboss Enterprise Application Platform, Jboss Fuse, Jbosseapxp and 1 more | 2026-11-09 | 8.8 High |
| A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server. | ||||
| CVE-2026-112317 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-09 | 5.3 Medium |
| krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures. | ||||
| CVE-2026-112314 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-09 | 7.5 High |
| clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries. | ||||
| CVE-2026-63644 | 1 Xddxdd | 1 Bird-lg-go | 2026-11-09 | 7.5 High |
| bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7. | ||||
| CVE-2026-125105 | 1 Wagtail | 1 Wagtail | 2026-11-09 | 3.7 Low |
| Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a document ID and a candidate SHA1 hash can submit If-Match or If-None-Match and distinguish the response, revealing whether that hash is present in the document library. The issue does not expose document contents, filenames, other metadata, or information about hashes the attacker does not already know. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2. | ||||
| CVE-2026-101456 | 1 Oracle | 2 Siebel Crm, Siebel Crm Development | 2026-11-09 | 6 Medium |
| Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-101457 | 1 Oracle | 2 Siebel Apps - Life Sciences, Siebel Crm | 2026-11-09 | 8.8 High |
| Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-125074 | 1 Sourcecodester | 1 Smart Attendance System With Qr Code Scanner | 2026-11-09 | 7.3 High |
| A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used. | ||||