Export limit exceeded: 416389 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416389 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416389 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112331 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop. | ||||
| CVE-2026-111594 | 1 Intersystems | 1 Iris For Health | 2026-10-26 | 8.1 High |
| InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | ||||
| CVE-2026-55981 | 1 Creative Labs | 1 Creative Sound Blaster Katana | 2026-10-26 | 9.6 Critical |
| A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. | ||||
| CVE-2026-63243 | 1 Creative Labs | 1 Creative Sound Blaster Katana | 2026-10-26 | 4.3 Medium |
| An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication. | ||||
| CVE-2026-63244 | 1 Wizlearn Technologies | 1 Learning Management System | 2026-10-26 | 9.8 Critical |
| An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform. | ||||
| CVE-2026-89312 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine. | ||||
| CVE-2026-89313 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found". | ||||
| CVE-2026-89314 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds. | ||||
| CVE-2026-89315 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names. | ||||
| CVE-2026-89316 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**. | ||||
| CVE-2026-89317 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were. | ||||
| CVE-2026-89318 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine. | ||||
| CVE-2026-89319 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error. | ||||
| CVE-2026-89320 | 1 Eclipse | 1 Keypont-gose | 2026-10-26 | N/A |
| `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely. | ||||
| CVE-2026-115749 | 1 Hydra-ecosystem | 1 Hydra-ray-launcher | 2026-10-26 | 3.3 Low |
| hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process. | ||||
| CVE-2026-81509 | 1 Nosduco | 1 Nforwardauth | 2026-10-26 | 6.1 Medium |
| nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch. | ||||
| CVE-2025-60469 | 2026-10-26 | 5.5 Medium | ||
| A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | ||||
| CVE-2026-106676 | 2026-10-26 | N/A | ||
| qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders. | ||||
| CVE-2026-115679 | 1 Keil | 1 Mdk-middleware | 2026-10-26 | 6.5 Medium |
| Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer | ||||
| CVE-2026-115680 | 1 Keil | 1 Mdk-middleware | 2026-10-26 | 6.5 Medium |
| Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission | ||||