Export limit exceeded: 410581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118564 | 1 Drupal | 1 Payumoney For Drupal Commerce | 2026-11-06 | 6.6 Medium |
| Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*. | ||||
| CVE-2026-123859 | 2026-11-06 | 8.1 High | ||
| When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, which could allow SQL injection. In both products, a crafted column name could have been used to chain additional SQL statements onto the generated statement, potentially allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role. Exploitation required an application to pass attacker controlled column names into this functionality. The fix is available in Snowflake Connector for Python version 4.8.1 and Snowflake Connector for Python (Universal Core) version 5.2.0. Users must upgrade manually. | ||||
| CVE-2026-123858 | 2026-11-06 | 4.4 Medium | ||
| In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects | ||||
| CVE-2026-123857 | 2026-11-06 | 4.3 Medium | ||
| In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection | ||||
| CVE-2026-123856 | 2026-11-06 | 6.5 Medium | ||
| In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server | ||||
| CVE-2026-123855 | 2026-11-06 | 7.5 High | ||
| In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs | ||||
| CVE-2026-123854 | 2026-11-06 | 5.5 Medium | ||
| In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module | ||||
| CVE-2026-123853 | 2026-11-06 | 7.8 High | ||
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process | ||||
| CVE-2026-123852 | 2026-11-06 | 7.4 High | ||
| In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates | ||||
| CVE-2026-123851 | 2026-11-06 | 5.4 Medium | ||
| In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters | ||||
| CVE-2026-123850 | 2026-11-06 | 3.5 Low | ||
| In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives | ||||
| CVE-2026-123849 | 2026-11-06 | 7 High | ||
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers | ||||
| CVE-2026-123848 | 2026-11-06 | 7.4 High | ||
| In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates | ||||
| CVE-2026-123847 | 2026-11-06 | 5.3 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion | ||||
| CVE-2026-123846 | 2026-11-06 | 4.3 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation | ||||
| CVE-2026-123845 | 2026-11-06 | 3.3 Low | ||
| In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects | ||||
| CVE-2026-123844 | 2026-11-06 | 5.3 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories | ||||
| CVE-2026-123843 | 2026-11-06 | 3.3 Low | ||
| In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration | ||||
| CVE-2026-123842 | 2026-11-06 | 7.1 High | ||
| In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives | ||||
| CVE-2026-123841 | 2026-11-06 | 7.8 High | ||
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive | ||||