Export limit exceeded: 405204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 405204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405204 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109271 | 1 Imagemagick | 1 Imagemagick | 2026-10-12 | 3.7 Low |
| ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application. | ||||
| CVE-2026-109278 | 1 Imagemagick | 1 Imagemagick | 2026-10-12 | 3.7 Low |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability. | ||||
| CVE-2026-109358 | 1 Edgelesssys | 1 Contrast | 2026-10-12 | 7.8 High |
| Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges. | ||||
| CVE-2026-109359 | 1 Edgelesssys | 1 Contrast | 2026-10-12 | 7.7 High |
| Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key. | ||||
| CVE-2025-49794 | 1 Redhat | 16 Cert Manager, Enterprise Linux, Hummingbird and 13 more | 2026-10-12 | 9.1 Critical |
| A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. | ||||
| CVE-2021-48009 | 2026-10-12 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-109424 | 2026-10-12 | 5.9 Medium | ||
| NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge. | ||||
| CVE-2026-109423 | 2026-10-12 | 7.4 High | ||
| NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery. | ||||
| CVE-2026-109422 | 2026-10-12 | 8.1 High | ||
| NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account. | ||||
| CVE-2026-66788 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-10-12 | 9.9 Critical |
| A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster. | ||||
| CVE-2026-96012 | 1 Ibm | 1 Db2 Mirror For I | 2026-10-12 | 9.9 Critical |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system. | ||||
| CVE-2026-108924 | 1 Getkirby | 1 Kirby | 2026-10-12 | 4.3 Medium |
| A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component. | ||||
| CVE-2026-109226 | 2 Lmsys, Sgl-project | 2 Sglang, Sglang | 2026-10-12 | 7.5 High |
| SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service. | ||||
| CVE-2026-109281 | 1 Imagemagick | 1 Imagemagick | 2026-10-12 | 4.4 Medium |
| ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents. | ||||
| CVE-2026-109283 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-12 | 5.4 Medium |
| Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role. | ||||
| CVE-2026-105465 | 1 Ibm | 1 Db2 | 2026-10-12 | 8.8 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. | ||||
| CVE-2026-78404 | 1 Ibm | 1 Db2 | 2026-10-12 | 6.5 Medium |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility. | ||||
| CVE-2026-84286 | 2026-10-12 | N/A | ||
| ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load. | ||||
| CVE-2026-109290 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-12 | 7.3 High |
| Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance. | ||||
| CVE-2026-109301 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-12 | 5.9 Medium |
| Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests. | ||||