Export limit exceeded: 414710 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414710 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12977 | 1 Redhat | 4 Jboss Enterprise Application Platform, Jboss Fuse, Jbosseapxp and 1 more | 2026-11-11 | 8.8 High |
| A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server. | ||||
| CVE-2026-123874 | 2026-11-11 | N/A | ||
| A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0). | ||||
| CVE-2026-96275 | 2 Flatpak, Redhat | 9 Flatpak, Enterprise Linux, Enterprise Linux Eus and 6 more | 2026-11-11 | 8.8 High |
| A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal. | ||||
| CVE-2026-123872 | 2026-11-11 | N/A | ||
| A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x. | ||||
| CVE-2026-110059 | 1 Microsoft | 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-110062 | 1 Microsoft | 12 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 9 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-110066 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-11 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-110067 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-11 | 8.8 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-111285 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-111288 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-11 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-110090 | 1 Adobe | 1 Premiere | 2026-11-11 | 7.1 High |
| Premiere Pro is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-110087 | 1 Adobe | 1 Premiere Pro | 2026-11-11 | 6.7 Medium |
| Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-110085 | 1 Adobe | 1 Premiere | 2026-11-11 | 7.8 High |
| Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-65843 | 2026-11-11 | N/A | ||
| sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7. | ||||
| CVE-2026-91878 | 2026-11-11 | 7.6 High | ||
| Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors | ||||
| CVE-2026-123877 | 2026-11-11 | N/A | ||
| A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x. | ||||
| CVE-2026-119055 | 2026-11-11 | N/A | ||
| CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could trick the end user to open a specially crafted malicious SSD file. | ||||
| CVE-2026-61637 | 2026-11-11 | 3.5 Low | ||
| Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1. | ||||
| CVE-2026-123871 | 2026-11-11 | N/A | ||
| Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x. | ||||
| CVE-2026-88924 | 2 Gnome, Redhat | 6 Gvfs, Enterprise Linux, Enterprise Linux Eus and 3 more | 2026-11-11 | 7 High |
| A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root. | ||||