Export limit exceeded: 407331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407331 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107220 | 2 Excelize, Qax-os | 2 Excelize, Excelize | 2026-10-13 | 6.5 Medium |
| Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review. | ||||
| CVE-2026-107221 | 2 Excelize, Qax-os | 2 Excelize, Excelize | 2026-10-13 | 6.5 Medium |
| Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review. | ||||
| CVE-2026-64006 | 1 Linux | 1 Linux Kernel | 2026-10-13 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value. Adding a temporary local variable to cache the original value before writing to dst and using it for the carry calculation solves the problem. In addition, partial overlap is rejected from control plane for all kind of operations including byteorder. This was tested with the following bytecode: table test_table ip flags 0 use 1 handle 1 ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1 ip test_table test_chain 2 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x66443322 0x00887766 ] [ counter pkts 0 bytes 0 ] ip test_table test_chain 4 3 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x55443322 0x00887766 ] [ counter pkts 21794 bytes 1917798 ] | ||||
| CVE-2026-95121 | 2026-10-13 | N/A | ||
| An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction | ||||
| CVE-2026-65200 | 2026-10-13 | 3.5 Low | ||
| The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately. | ||||
| CVE-2026-65199 | 2026-10-13 | 5.4 Medium | ||
| openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user. | ||||
| CVE-2026-107222 | 2 Excelize, Qax-os | 2 Excelize, Excelize | 2026-10-13 | 6.5 Medium |
| Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review. | ||||
| CVE-2026-107223 | 2 Excelize, Qax-os | 2 Excelize, Excelize | 2026-10-13 | 7.5 High |
| Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review. | ||||
| CVE-2026-65198 | 2026-10-13 | 8.6 High | ||
| Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades. | ||||
| CVE-2026-65197 | 2026-10-13 | 3.1 Low | ||
| H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding. | ||||
| CVE-2026-95680 | 1 Ibm | 1 Websphere Application Server | 2026-10-13 | 8 High |
| IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell. | ||||
| CVE-2026-93892 | 1 Ibm | 1 Tririga Application Platform | 2026-10-13 | 8.1 High |
| IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response. | ||||
| CVE-2026-93886 | 1 Ibm | 1 I | 2026-10-13 | 8.3 High |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input. | ||||
| CVE-2026-90912 | 1 Ibm | 1 Maximo Ai Service | 2026-10-13 | 7.5 High |
| IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion. | ||||
| CVE-2026-89124 | 1 Sap Se | 1 Sap Hana (display Product Catalog Based On Customs Declaration) | 2026-10-13 | 4.3 Medium |
| Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application. | ||||
| CVE-2026-89122 | 1 Sap | 1 Netweaver Enterprise Portal | 2026-10-13 | 6.1 Medium |
| SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability. | ||||
| CVE-2026-89121 | 1 Sap Se | 1 Sap S/4hana (linear Asset Management Rap Business Object) | 2026-10-13 | 4.7 Medium |
| SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability. | ||||
| CVE-2026-89120 | 1 Sap | 1 Abap Platform | 2026-10-13 | 7.1 High |
| A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability. | ||||
| CVE-2026-89118 | 1 Sap | 1 Netweaver Enterprise Portal | 2026-10-13 | 5.3 Medium |
| SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application. | ||||
| CVE-2026-89117 | 1 Sap | 1 Netweaver Enterprise Portal | 2026-10-13 | 6.1 Medium |
| SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability. | ||||