Export limit exceeded: 109606 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109606 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17337 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.4 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication. | ||||
| CVE-2026-17334 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys. | ||||
| CVE-2026-17332 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.7 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation. | ||||
| CVE-2026-17330 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||
| CVE-2026-17327 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||
| CVE-2026-17326 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.1 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | ||||
| CVE-2026-17325 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. | ||||
| CVE-2026-17324 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.3 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function. | ||||
| CVE-2026-17322 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.1 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files. | ||||
| CVE-2026-17321 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.1 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference. | ||||
| CVE-2026-17319 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.1 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service. | ||||
| CVE-2026-17316 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.2 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input. | ||||
| CVE-2026-17311 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.1 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization. | ||||
| CVE-2026-17309 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation. | ||||
| CVE-2026-17187 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. | ||||
| CVE-2026-17172 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party. | ||||
| CVE-2026-82159 | 1 Dell | 1 Wyse Management Suite | 2026-11-07 | 8.8 High |
| Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2026-57154 | 1 Opnsense | 1 Core | 2026-11-07 | 8.1 High |
| OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1. | ||||
| CVE-2026-46487 | 2026-11-07 | 7.5 High | ||
| GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11. | ||||
| CVE-2026-121561 | 1 Humansignal | 1 Label Studio | 2026-11-07 | 7.7 High |
| Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token. | ||||