Export limit exceeded: 424129 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424129 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-42858 | 1 Openedx | 2 Openedx, Openedx-platform | 2026-10-26 | 8.5 High |
| Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054. | ||||
| CVE-2026-7308 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-26 | 5.4 Medium |
| An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session. | ||||
| CVE-2026-8320 | 1 Jishenghua | 1 Jsherp | 2026-10-26 | 4.7 Medium |
| A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-8318 | 1 Vectifyai | 1 Pageindex | 2026-10-26 | 5.3 Medium |
| A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a119577a1929decba. Affected by this vulnerability is the function toc_transformer of the file pageindex/page_index.py of the component PDF Table of Contents Handler. The manipulation results in infinite loop. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. | ||||
| CVE-2026-42565 | 1 Workos | 1 Authkit-session | 2026-10-26 | 4.3 Medium |
| @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1. | ||||
| CVE-2026-44413 | 1 Jetbrains | 1 Teamcity | 2026-10-26 | 8.2 High |
| In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access | ||||
| CVE-2026-43896 | 1 Jqlang | 1 Jq | 2026-10-26 | 6.2 Medium |
| jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects. | ||||
| CVE-2026-42864 | 1 Manomanotech | 1 Firefighter-incident | 2026-10-26 | 9.9 Critical |
| FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54. | ||||
| CVE-2026-69968 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-26 | 6.5 Medium |
| Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2025-60478 | 1 Gpac | 1 Mp4box | 2026-10-26 | 5.5 Medium |
| A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file. | ||||
| CVE-2025-60479 | 1 Gpac | 1 Mp4box | 2026-10-26 | 5.5 Medium |
| A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file. | ||||
| CVE-2025-71438 | 1 Gpac | 1 Mp4box | 2026-10-26 | 5.5 Medium |
| An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | ||||
| CVE-2026-69969 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-26 | 4.7 Medium |
| Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69970 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-26 | 7 High |
| Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69971 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-26 | 5.5 Medium |
| Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69973 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-26 | 6.5 Medium |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-69974 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-26 | 4.7 Medium |
| Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-115189 | 1 Mautic | 1 Mautic | 2026-10-26 | 8.8 High |
| A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg. | ||||
| CVE-2026-115192 | 1 Mautic | 1 Mautic | 2026-10-26 | 7.1 High |
| An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled. | ||||
| CVE-2026-115194 | 1 Mautic | 1 Mautic | 2026-10-26 | 6.5 Medium |
| A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents. | ||||