Export limit exceeded: 412929 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412929 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-98157 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned long, but the target field (poll_msec) is unsigned int. On 64-bit systems, a value > UINT_MAX is silently truncated when stored. Fix the mismatch by using kstrtouint() instead. This rejects values larger than UINT_MAX at parse time, making truncation impossible. Also add a check for value < 1 to reject the 0-delay case, which would cause the poll work to spin without delay and consume 100% CPU. | ||||
| CVE-2026-113507 | 1 Aapanel | 1 Aapanel | 2026-10-20 | 5.3 Medium |
| A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed". | ||||
| CVE-2026-111922 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-10-20 | 6.3 Medium |
| Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account. | ||||
| CVE-2026-28331 | 1 Solarwinds | 1 Patch Manager | 2026-10-20 | 4.4 Medium |
| SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges. | ||||
| CVE-2026-102189 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-20 | 7 High |
| Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102191 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-20 | 7 High |
| Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102192 | 1 Microsoft | 5 Windows Server 2019, Windows Server 2019 (server Core Installation), Windows Server 2022 and 2 more | 2026-10-20 | 7.5 High |
| Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-102193 | 1 Microsoft | 15 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 12 more | 2026-10-20 | 7 High |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102194 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 7 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-98155 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker(). | ||||
| CVE-2026-102195 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-10-20 | 7 High |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-86404 | 1 Redhat | 7 Amq Broker, Build Of Apache Camel For Quarkus, Build Of Apache Camel For Spring Boot and 4 more | 2026-10-20 | 8.8 High |
| EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default. | ||||
| CVE-2026-77936 | 1 Letta | 1 Letta | 2026-10-20 | 9.8 Critical |
| Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM. | ||||
| CVE-2026-64610 | 2026-10-20 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-63619 | 2 Apache, Apache Software Foundation | 2 Apache Kylin, Apache Kylin | 2026-10-20 | 9.1 Critical |
| Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-43851 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system. | ||||
| CVE-2026-43849 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. | ||||
| CVE-2026-43847 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled. | ||||
| CVE-2026-43846 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. | ||||
| CVE-2026-3303 | 1 Ibm | 1 Concert | 2026-10-20 | 3.7 Low |
| IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains. | ||||