Export limit exceeded: 407502 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407502 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407502 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55562 | 1 Jhuckaby | 1 Cronicle | 2026-10-13 | 9 Critical |
| Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119. | ||||
| CVE-2026-96594 | 1 Gitea | 1 Gitea | 2026-10-13 | 6.1 Medium |
| The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions. | ||||
| CVE-2026-97208 | 1 Gitea | 1 Gitea | 2026-10-13 | 4.9 Medium |
| The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule. | ||||
| CVE-2026-108384 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists. | ||||
| CVE-2026-108383 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names. | ||||
| CVE-2026-92892 | 2026-10-13 | 9 Critical | ||
| Potential arbitrary code execution, under specific configurations. | ||||
| CVE-2026-102603 | 1 Gotify | 1 Server | 2026-10-13 | N/A |
| Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0. | ||||
| CVE-2026-53420 | 1 Zoom Communications | 1 Zoom Workplace | 2026-10-13 | 8 High |
| Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access. | ||||
| CVE-2026-18228 | 2026-10-13 | N/A | ||
| HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents. | ||||
| CVE-2026-77090 | 2026-10-13 | N/A | ||
| CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS. | ||||
| CVE-2026-77095 | 2026-10-13 | N/A | ||
| CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale. | ||||
| CVE-2026-77362 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-13 | 4.3 Medium |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates. | ||||
| CVE-2026-108381 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments. | ||||
| CVE-2026-108379 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names. | ||||
| CVE-2026-16516 | 2 Wolfssh, Wolfssl | 2 Wolfssh, Wolfssh | 2026-10-13 | 7.4 High |
| wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key). | ||||
| CVE-2020-9287 | 1 Fortinet | 2 Forticlient Emergency Management Server, Forticlientems | 2026-10-13 | 7.5 High |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2020-9290 | 1 Fortinet | 3 Forticlient, Forticlient Virtual Private Network, Forticlientwindows | 2026-10-13 | 7.1 High |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2019-5589 | 1 Fortinet | 2 Forticlient, Forticlientwindows | 2026-10-13 | 8.6 High |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2020-12811 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2026-10-13 | 4.9 Medium |
| A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2026-106171 | 1 Fortinet | 2 Fortimanager, Fortimanagercloud | 2026-10-13 | 5.3 Medium |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets | ||||