Export limit exceeded: 416232 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416232 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416232 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119723 | 1 Facebook | 1 Hhvm | 2026-11-14 | N/A |
| When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5. | ||||
| CVE-2026-111339 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-120861 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-120862 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-91094 | 1 Debian | 1 Dpkg | 2026-11-14 | N/A |
| A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks. | ||||
| CVE-2026-125747 | 1 Easysoft | 1 Zentaopms | 2026-11-14 | 5.4 Medium |
| ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects. | ||||
| CVE-2026-125749 | 1 Vas3k | 1 Taxhacker | 2026-11-14 | 4.2 Medium |
| TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts. | ||||
| CVE-2026-85838 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85839 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69327 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.4 High |
| Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-70231 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96031 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-126997 | 2 Jeecg, Jeecgboot | 2 Jeecgboot, Jeecgboot | 2026-11-14 | 7.3 High |
| A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag/flow/c/a.class of the component flow-run Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-126998 | 2 Jeecg, Jeecgboot | 2 Jeecgboot, Jeecgboot | 2026-11-14 | 7.3 High |
| A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-125824 | 2 Wordpress-extensions, Wp Go Maps | 2 Wp Go Maps, Wp Go Maps | 2026-11-14 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10. | ||||
| CVE-2026-125808 | 2 Htmega, Wordpress-extensions | 2 Ht Mega, Ht Mega | 2026-11-14 | 5.3 Medium |
| Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8. | ||||
| CVE-2026-125807 | 2 Htmega, Wordpress-extensions | 2 Ht Mega, Ht Mega | 2026-11-14 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8. | ||||
| CVE-2026-125835 | 2 Crocoblock, Wordpress-extensions | 2 Jettabs, Jettabs | 2026-11-14 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5. | ||||
| CVE-2026-125440 | 2 Cristián Lávaque, Wordpress-extensions | 2 S2member, S2member | 2026-11-14 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 261106. | ||||
| CVE-2026-125834 | 2 Wordpress-extensions, Wp Media | 2 Imagify, Imagify | 2026-11-14 | 4.3 Medium |
| Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4. | ||||