Export limit exceeded: 408576 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408576 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-83635 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-14 | 7.5 High |
| Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-102298 | 2026-10-14 | N/A | ||
| In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts. | ||||
| CVE-2026-96596 | 2 Erlang, Hexpm | 4 Erlang\/otp, Rebar3, Hex and 1 more | 2026-10-14 | N/A |
| Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member. When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected. hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3. This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to stdlib from 8.0 before 8.1.1, and rebar3 from 3.27.1 onward, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1. | ||||
| CVE-2026-110698 | 1 Praat | 1 Praat | 2026-10-14 | 6.3 Medium |
| A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)." | ||||
| CVE-2026-86563 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-10-14 | 7.8 High |
| A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. | ||||
| CVE-2026-101974 | 2026-10-14 | 6.5 Medium | ||
| An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to disclose rpd memory or cause a rpd crash via a malformed OSPF packets. | ||||
| CVE-2026-100236 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-10-14 | 8.6 High |
| A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write. | ||||
| CVE-2026-101934 | 2026-10-14 | 4.4 Medium | ||
| An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service. | ||||
| CVE-2026-101937 | 2026-10-14 | 6.5 Medium | ||
| A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic. | ||||
| CVE-2026-108337 | 2026-10-14 | N/A | ||
| An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability. | ||||
| CVE-2026-108336 | 2026-10-14 | N/A | ||
| When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability. | ||||
| CVE-2026-101970 | 2026-10-14 | 6.5 Medium | ||
| A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. | ||||
| CVE-2026-101971 | 2026-10-14 | 6.5 Medium | ||
| An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an enabled broadcast interface. | ||||
| CVE-2026-101961 | 2026-10-14 | 7.5 High | ||
| A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy. | ||||
| CVE-2026-110772 | 2026-10-14 | 4.3 Medium | ||
| Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports. | ||||
| CVE-2026-110762 | 1 Bbpress | 1 Bbpress | 2026-10-14 | 3.7 Low |
| bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint. | ||||
| CVE-2026-101963 | 2026-10-14 | 7.5 High | ||
| An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured. | ||||
| CVE-2023-3610 | 3 Debian, Linux, Redhat | 3 Debian Linux, Linux Kernel, Enterprise Linux | 2026-10-14 | 7.8 High |
| A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. | ||||
| CVE-2023-3609 | 3 Debian, Linux, Redhat | 9 Debian Linux, Linux Kernel, Enterprise Linux and 6 more | 2026-10-14 | 7.8 High |
| A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. | ||||
| CVE-2023-3446 | 2 Openssl, Redhat | 5 Openssl, Enterprise Linux, Jboss Core Services and 2 more | 2026-10-14 | 5.3 Medium |
| Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. | ||||