Export limit exceeded: 413273 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413273 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-10071 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.3 Medium |
| A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 2.12 is able to resolve this issue. The name of the patch is d53365e5656f6499a4deddf89d522814655f769d. The affected component should be upgraded. | ||||
| CVE-2025-10070 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.3 Medium |
| A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 2.12 is able to mitigate this issue. Patch name: d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component. | ||||
| CVE-2025-10013 | 1 Portabilis | 1 I-educar | 2026-10-20 | 6.3 Medium |
| A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. The patch is named d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component. | ||||
| CVE-2026-42025 | 2026-10-20 | 9.1 Critical | ||
| Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter. | ||||
| CVE-2026-88080 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 7.8 High |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96628 | 1 Getarcaneapp | 1 Arcane | 2026-10-20 | 4.3 Medium |
| Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0. | ||||
| CVE-2024-2323 | 1 Wso2 | 8 Identity Server, Wso2 Api Manager, Wso2 Carbon User Manager Kernel and 5 more | 2026-10-20 | 4.8 Medium |
| The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise. | ||||
| CVE-2026-76587 | 1 Ibm | 1 Planning Analytics | 2026-10-20 | 8.8 High |
| IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. | ||||
| CVE-2026-43834 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution. | ||||
| CVE-2026-43838 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | ||||
| CVE-2026-43848 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. | ||||
| CVE-2026-43850 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. | ||||
| CVE-2026-43852 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system. | ||||
| CVE-2026-43853 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash. | ||||
| CVE-2026-43854 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices. | ||||
| CVE-2026-43856 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes. | ||||
| CVE-2026-81212 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-20 | 10 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters. | ||||
| CVE-2026-82891 | 1 Ibm | 1 Guardium Data Protection | 2026-10-20 | 8.1 High |
| IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. | ||||
| CVE-2026-92559 | 1 Ibm | 1 App Connect Enterprise | 2026-10-20 | 9.8 Critical |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. | ||||
| CVE-2026-93441 | 1 Ibm | 1 Qradar Security Information And Event Management | 2026-10-20 | 8.6 High |
| IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||