Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408108 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107820 | 1 Duty1g | 1 X64dbg-mcp-server | 2026-10-13 | 5.3 Medium |
| x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in unchecked usize addition in wsRecv() before token authentication. The server listens on 0.0.0.0 by default in affected versions. An unauthenticated network client can supply a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds, terminating the entire x64dbg process and its live debugging session. The overflowed value is used only in a comparison, so the impact is limited to denial of service rather than memory corruption or code execution. This issue is fixed in version 1.2. | ||||
| CVE-2026-104085 | 2026-10-13 | 8.8 High | ||
| odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $(id) in a non-.odt filename, which survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), to achieve remote code execution as the web-server user during the LibreOffice conversion process. | ||||
| CVE-2026-103030 | 2026-10-13 | 7.5 High | ||
| Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0. | ||||
| CVE-2024-58389 | 1 Holoviz | 1 Panel | 2026-10-13 | 6.1 Medium |
| HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login. | ||||
| CVE-2020-37279 | 1 Karuppiah7890 | 1 Easy-pdf-merge | 2026-10-13 | 8.1 High |
| easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges. | ||||
| CVE-2026-109744 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109742 | 1 Mozilla | 1 Firefox | 2026-10-13 | 4.3 Medium |
| Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109724 | 1 Mozilla | 1 Firefox | 2026-10-13 | 5.4 Medium |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109723 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109720 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109707 | 1 Mozilla | 1 Firefox | 2026-10-13 | 9.6 Critical |
| Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109705 | 1 Mozilla | 1 Firefox | 2026-10-13 | 9.6 Critical |
| Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109753 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109726 | 2026-10-13 | 5.4 Medium | ||
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109719 | 2026-10-13 | 4.2 Medium | ||
| Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109718 | 2026-10-13 | 5.4 Medium | ||
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109716 | 2026-10-13 | N/A | ||
| Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-53418 | 1 Zoom Communications | 1 Zoom Workplace | 2026-10-13 | 8.1 High |
| Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access. | ||||
| CVE-2026-77094 | 2026-10-13 | N/A | ||
| CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale. | ||||
| CVE-2026-77096 | 2026-10-13 | N/A | ||
| CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS. | ||||