Export limit exceeded: 404999 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (404999 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109243 | 1 Freerdp | 1 Freerdp | 2026-10-12 | 4.4 Medium |
| FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy. | ||||
| CVE-2026-109242 | 1 Freerdp | 1 Freerdp | 2026-10-12 | 7.1 High |
| FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process. | ||||
| CVE-2026-109241 | 1 Freerdp | 1 Freerdp | 2026-10-12 | 3.1 Low |
| FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it, causing client denial of service. | ||||
| CVE-2026-109240 | 1 Freerdp | 1 Freerdp | 2026-10-12 | 3.1 Low |
| FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request with OutputBufferSize above INT32_MAX over URBDRC, triggering an assertion in libusb_udev_isoch_transfer that terminates the client. | ||||
| CVE-2026-85958 | 2026-10-12 | 7.5 High | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access. | ||||
| CVE-2026-85957 | 2026-10-12 | 7.5 High | ||
| Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure. | ||||
| CVE-2026-85956 | 2026-10-12 | 9.6 Critical | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data. | ||||
| CVE-2026-108906 | 1 Netcore | 1 Nr268 | 2026-10-12 | 7.2 High |
| A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-109227 | 2 Lmsys, Sgl-project | 2 Sglang, Sglang | 2026-10-12 | 7.5 High |
| SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service. | ||||
| CVE-2026-85955 | 2026-10-12 | 9.9 Critical | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions. | ||||
| CVE-2026-85954 | 2026-10-12 | 8.6 High | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions. | ||||
| CVE-2026-85953 | 2026-10-12 | 8.5 High | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity. | ||||
| CVE-2026-85952 | 2026-10-12 | 8.5 High | ||
| Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials. | ||||
| CVE-2026-85951 | 2026-10-12 | 8.5 High | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens. | ||||
| CVE-2026-81856 | 1 Hexpm | 1 Hex | 2026-10-12 | N/A |
| Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentation search service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.print_error_result/1. A malicious package can embed ANSI escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) or Unicode bidirectional overrides in any of those fields, so the bytes reach the terminal unchanged, forging displayed URLs, package descriptions and suggested commands, concealing real output, or writing to the clipboard. No authentication or privileged position is required; only publishing a package. This issue affects hex: from 0.0.1 before 2.5.2. | ||||
| CVE-2026-109228 | 2 Lmsys, Sgl-project | 2 Sglang, Sglang | 2026-10-12 | 7.5 High |
| SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service. | ||||
| CVE-2026-108895 | 1 Linksys | 2 E1700, E1700 Firmware | 2026-10-12 | 9.9 Critical |
| A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108901 | 1 Shenzhen Hcc Technology | 1 Mpos M6 Plus | 2026-10-12 | 3.5 Low |
| A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-103060 | 1 Erlang | 1 Rebar3 | 2026-10-12 | N/A |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies. A package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing. This issue affects rebar3: from 3.7.0-rc1 before 3.27.2. | ||||
| CVE-2026-85950 | 2026-10-12 | 8.4 High | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access. | ||||