Export limit exceeded: 409293 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409293 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18418 | 1 Zephyrproject | 1 Zephyr | 2026-10-15 | 3.4 Low |
| The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all). Any peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain — typically a second core on the same SoC. The resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)). | ||||
| CVE-2026-111129 | 1 Assimp | 1 Assimp | 2026-10-15 | 5.5 Medium |
| Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation track targeting a missing submesh or absent shared geometry to crash the host process. | ||||
| CVE-2026-111125 | 2026-10-15 | 6.1 Medium | ||
| CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory. | ||||
| CVE-2026-111124 | 2026-10-15 | 6.1 Medium | ||
| CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels. | ||||
| CVE-2026-110958 | 1 Wavlink | 1 Wn530hg4b | 2026-10-15 | 10 Critical |
| A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked." | ||||
| CVE-2026-110890 | 2026-10-15 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6. | ||||
| CVE-2026-110855 | 1 Gitpython Project | 1 Gitpython | 2026-10-15 | 6.5 Medium |
| GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs. | ||||
| CVE-2026-110850 | 1 N8n | 1 N8n | 2026-10-15 | N/A |
| n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination. | ||||
| CVE-2026-110840 | 1 N8n | 1 N8n | 2026-10-15 | N/A |
| n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges. | ||||
| CVE-2026-110830 | 1 Freerdp | 1 Freerdp | 2026-10-15 | 5.9 Medium |
| FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion. | ||||
| CVE-2026-110767 | 2026-10-15 | 7.5 High | ||
| Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB. | ||||
| CVE-2026-110374 | 2026-10-15 | 4.3 Medium | ||
| Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77. | ||||
| CVE-2026-110367 | 2026-10-15 | 5.3 Medium | ||
| Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5. | ||||
| CVE-2026-109689 | 2026-10-15 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4. | ||||
| CVE-2026-109449 | 1 Sensiolabs | 1 Symfony | 2026-10-15 | N/A |
| In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8. | ||||
| CVE-2026-109438 | 2026-10-15 | 5.3 Medium | ||
| 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections. | ||||
| CVE-2026-109413 | 1 Sensiolabs | 1 Symfony | 2026-10-15 | N/A |
| In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5. | ||||
| CVE-2026-109080 | 1 Flock | 1 Night Shift | 2026-10-15 | 6.5 Medium |
| SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required. | ||||
| CVE-2026-108976 | 1 Gnu | 1 Emacs | 2026-10-15 | 7.8 High |
| GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992. | ||||
| CVE-2026-108116 | 2026-10-15 | 7.5 High | ||
| In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection. | ||||