Export limit exceeded: 416137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416137 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126291 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.8 High |
| NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials. | ||||
| CVE-2026-126292 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 4.3 Medium |
| NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking. | ||||
| CVE-2026-126293 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota. | ||||
| CVE-2026-126294 | 1 Getgrav | 1 Grav | 2026-11-13 | 7.5 High |
| Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control. | ||||
| CVE-2026-126295 | 1 Nltk | 1 Nltk | 2026-11-13 | 6.8 Medium |
| NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices. | ||||
| CVE-2026-126296 | 1 Nltk | 1 Nltk | 2026-11-13 | 4.8 Medium |
| NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly. | ||||
| CVE-2026-126297 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes. | ||||
| CVE-2026-126298 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread. | ||||
| CVE-2026-126299 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads. | ||||
| CVE-2026-126300 | 1 Nltk | 1 Nltk | 2026-11-13 | 5.3 Medium |
| NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability. | ||||
| CVE-2026-126301 | 1 Nltk | 1 Nltk | 2026-11-13 | 5.3 Medium |
| NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components. | ||||
| CVE-2026-126302 | 1 Nltk | 1 Nltk | 2026-11-13 | 3.3 Low |
| NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox. | ||||
| CVE-2026-126303 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools. | ||||
| CVE-2026-126304 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox. | ||||
| CVE-2026-126305 | 1 Espocrm | 1 Espocrm | 2026-11-13 | 7.3 High |
| EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials. | ||||
| CVE-2026-126306 | 1 Espocrm | 1 Espocrm | 2026-11-13 | 8 High |
| EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator. | ||||
| CVE-2026-126308 | 1 Coder | 1 Coder | 2026-11-13 | 7.7 High |
| The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination. | ||||
| CVE-2026-126309 | 1 Openbao | 1 Openbao | 2026-11-13 | 7.1 High |
| OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names. | ||||
| CVE-2026-126310 | 1 Openbao | 1 Openbao | 2026-11-13 | 8.7 High |
| OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret. | ||||
| CVE-2026-126311 | 1 Openbao | 1 Openbao | 2026-11-13 | 5.8 Medium |
| OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users. | ||||