Export limit exceeded: 408757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408757 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-6170 | 2 Redhat, Xmlsoft | 18 Ai Inference Server, Cert Manager, Discovery and 15 more | 2026-10-14 | 2.5 Low |
| A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections. | ||||
| CVE-2026-102864 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 4.6 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-102862 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 8.8 High |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102861 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server Subscription Edition | 2026-10-14 | 8.8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69943 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-10-14 | 8.8 High |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-110669 | 1 Cemtan | 1 Sar2html | 2026-10-14 | 6.5 Medium |
| A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-55679 | 2026-10-14 | 6.5 Medium | ||
| WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6. | ||||
| CVE-2026-107362 | 1 Cisagov | 1 Malcolm | 2026-10-14 | 7.1 High |
| Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content. | ||||
| CVE-2026-55680 | 2026-10-14 | 9.8 Critical | ||
| WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6. | ||||
| CVE-2026-14999 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 7.4 High |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures. | ||||
| CVE-2026-94587 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 4.5 Medium |
| A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon. | ||||
| CVE-2026-94586 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 6.8 Medium |
| A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges | ||||
| CVE-2026-94585 | 3 Broadcom, Brocade, Dell | 3 Fabric Operating System, Fabric Os, Mxg610s | 2026-10-14 | 8.8 High |
| An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface. | ||||
| CVE-2026-94581 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 6.8 Medium |
| An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system. | ||||
| CVE-2026-94579 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 8.0 High |
| An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes. | ||||
| CVE-2026-94577 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 7.8 High |
| A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root | ||||
| CVE-2026-94576 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 8.0 High |
| An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation. | ||||
| CVE-2026-87677 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 6.6 Medium |
| An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection. | ||||
| CVE-2026-87664 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 7.8 High |
| A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication. | ||||
| CVE-2026-87663 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-14 | 6.7 Medium |
| An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. This allows an attacker on a single fabric-connected switch to escalate privileges and execute arbitrary root commands locally or across other managed fabric members where remote execution functionality is enabled. | ||||