Export limit exceeded: 407716 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407716 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107265 | 2026-10-30 | 5.4 Medium | ||
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13. | ||||
| CVE-2026-107264 | 2026-10-30 | 5.4 Medium | ||
| Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0. | ||||
| CVE-2026-107263 | 2026-10-30 | 5.4 Medium | ||
| Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7. | ||||
| CVE-2026-107261 | 2026-10-30 | 4.2 Medium | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | ||||
| CVE-2026-107259 | 2026-10-30 | 5.4 Medium | ||
| Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0. | ||||
| CVE-2026-107258 | 2026-10-30 | 5.4 Medium | ||
| Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6. | ||||
| CVE-2026-107257 | 2026-10-30 | 6.5 Medium | ||
| Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | ||||
| CVE-2026-107254 | 2026-10-30 | 4.8 Medium | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | ||||
| CVE-2026-107253 | 2026-10-30 | 5.9 Medium | ||
| Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*. | ||||
| CVE-2026-107252 | 2026-10-30 | 5.4 Medium | ||
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2. | ||||
| CVE-2026-107251 | 2026-10-30 | 6.5 Medium | ||
| Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | ||||
| CVE-2026-107250 | 2026-10-30 | 5.9 Medium | ||
| Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | ||||
| CVE-2026-107249 | 2026-10-30 | 9.8 Critical | ||
| Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2. | ||||
| CVE-2026-103299 | 2026-10-30 | 5.3 Medium | ||
| The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured. | ||||
| CVE-2026-62300 | 2026-10-30 | 6.5 Medium | ||
| Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a caller-supplied CID with `CID.parse` and passes it to `pinStore.pin`, but does not enforce request rate limits or per-user quotas. In `src/filecoin-pin-store.ts`, each pin independently schedules `_processPinInBackground` with `setTimeout` without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using `helia.pins.add(cid)`. The per-pin Helia/Bitswap node in `src/create-pinning-helia.ts` has no application-level byte, block or traversal-time limits. Blocks are written under `carStoragePath` by `src/core/car/car-blockstore-base.ts` and `src/core/car/car-file-backend.ts`, with `stats.totalSize` updated only after writing. An authenticated caller, or an anonymous caller when `ALLOW_NO_AUTH=true`, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied `origins` can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls. | ||||
| CVE-2026-87941 | 1 Drupal | 1 Patreon | 2026-10-30 | 5.9 Medium |
| Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | ||||
| CVE-2026-106781 | 2026-10-30 | 7.8 High | ||
| An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. | ||||
| CVE-2026-51905 | 1 Transformeroptimus | 1 Superagi | 2026-10-30 | 8.8 High |
| TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution. | ||||
| CVE-2026-117346 | 1 Bitcoin | 1 Bitcoin Core | 2026-10-30 | N/A |
| Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit | ||||
| CVE-2026-61848 | 1 Rgrove | 1 Crass | 2026-10-30 | N/A |
| Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear parsing time. An attacker-controlled CSS input consisting of many `non-ASCII characters` can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7. | ||||