Export limit exceeded: 400945 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400945 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85611 | 1 Openpanel | 1 Openpanel | 2026-10-02 | 6.4 Medium |
| OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries. | ||||
| CVE-2026-85610 | 1 Openpanel | 1 Openpanel | 2026-10-02 | 8.8 High |
| OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries. | ||||
| CVE-2026-85609 | 1 Openpanel | 1 Openpanel | 2026-10-02 | 7.5 High |
| Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party). | ||||
| CVE-2026-104614 | 1 Codeastro | 1 Simple Pharmacy Management System | 2026-10-02 | 6.3 Medium |
| A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-88265 | 1 Redhat | 4 Enterprise Linux, Hardened Images, Hummingbird and 1 more | 2026-10-02 | 5.6 Medium |
| A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet. | ||||
| CVE-2026-84233 | 1 Redhat | 3 Enterprise Linux, Hardened Images, Hummingbird | 2026-10-02 | 7 High |
| A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. | ||||
| CVE-2026-19617 | 1 Redhat | 5 Enterprise Linux, Hardened Images, Hummingbird and 2 more | 2026-10-02 | 5.5 Medium |
| A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems. | ||||
| CVE-2026-56392 | 1 Gnu | 1 Coreutils | 2026-10-02 | 6.1 Medium |
| GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write. When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout. This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d | ||||
| CVE-2022-2327 | 2 Linux, Netapp | 11 Linux Kernel, H300s, H300s Firmware and 8 more | 2026-10-02 | 7.5 High |
| io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 | ||||
| CVE-2026-84414 | 1 Ibm | 1 I | 2026-10-02 | 7.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path. | ||||
| CVE-2026-103505 | 1 Aws | 1 Aws-efs-csi-driver | 2026-10-02 | 6.5 Medium |
| Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute. To remediate this issue, users should upgrade to version v3.5.0 or later. | ||||
| CVE-2026-84421 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-02 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction. | ||||
| CVE-2026-84422 | 2 Ibm, Linux | 2 Guardium Data Protection, Linux Kernel | 2026-10-02 | 7.2 High |
| IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges. | ||||
| CVE-2026-84436 | 2 Ibm, Linux | 2 Guardium Data Protection, Linux Kernel | 2026-10-02 | 9.1 Critical |
| IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges. | ||||
| CVE-2026-104420 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-02 | 5.3 Medium |
| Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned. | ||||
| CVE-2026-104421 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-02 | 5.3 Medium |
| Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip. | ||||
| CVE-2026-104427 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-02 | 5.9 Medium |
| Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks. | ||||
| CVE-2026-104428 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-02 | 5.3 Medium |
| The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop. | ||||
| CVE-2026-95360 | 1 Google | 1 Chrome | 2026-10-02 | 5.3 Medium |
| Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95361 | 1 Google | 1 Chrome | 2026-10-02 | 4.3 Medium |
| Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||