Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415337 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121687 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-12 | 9.8 Critical |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22) | ||||
| CVE-2026-121686 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-12 | 9.8 Critical |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet. | ||||
| CVE-2026-121685 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-12 | 9.8 Critical |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges. | ||||
| CVE-2026-113508 | 1 Apache | 1 Airflow | 2026-11-12 | 7.5 High |
| Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later. | ||||
| CVE-2026-113504 | 1 Apache | 1 Airflow | 2026-11-12 | 6.5 Medium |
| Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later. | ||||
| CVE-2026-107474 | 1 Apache | 1 Airflow | 2026-11-12 | 6.5 Medium |
| The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later. | ||||
| CVE-2026-101031 | 1 Apache | 1 Airflow | 2026-11-12 | 9.1 Critical |
| The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production. | ||||
| CVE-2026-126724 | 2026-11-12 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface. | ||||
| CVE-2026-126723 | 2026-11-12 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface. | ||||
| CVE-2026-126166 | 1 Fortinet | 1 Fortimail | 2026-11-12 | 7.2 High |
| A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface. | ||||
| CVE-2026-122475 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-11-12 | 8.8 High |
| Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118104 | 1 Microsoft | 12 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 (gdr) and 9 more | 2026-11-12 | 6.5 Medium |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-118119 | 1 Microsoft | 9 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more | 2026-11-12 | 8 High |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-119995 | 1 Microsoft | 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more | 2026-11-12 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119997 | 1 Microsoft | 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more | 2026-11-12 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-120976 | 1 Arista | 1 Eos | 2026-11-12 | 6 Medium |
| On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU). An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link. The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present. | ||||
| CVE-2026-120978 | 1 Arista | 1 Eos | 2026-11-12 | 6.5 Medium |
| On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required. | ||||
| CVE-2026-121369 | 1 Arista | 1 Eos | 2026-11-12 | 5.3 Medium |
| On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot. | ||||
| CVE-2026-106154 | 2026-11-12 | 8.6 High | ||
| In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`. | ||||
| CVE-2026-126193 | 2026-11-12 | 5.3 Medium | ||
| Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0. | ||||