Export limit exceeded: 400955 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400955 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400955 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400955 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400955 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-51873 | 1 Stitionai | 1 Devika | 2026-10-02 | N/A |
| Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace. | ||||
| CVE-2026-51882 | 1 Chatchat-space | 1 Langchain-chatchat | 2026-10-02 | N/A |
| The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames. | ||||
| CVE-2026-71449 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-01 | N/A |
| : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-64892 | 1 Johnson Controls | 1 Easy Io Neo | 2026-10-01 | N/A |
| - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63. | ||||
| CVE-2026-48005 | 2 Apache, Redhat | 2 Apache Http Server, Hummingbird | 2026-10-01 | 7.5 High |
| Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue. | ||||
| CVE-2026-102514 | 1 Peazip | 1 Peazip | 2026-10-01 | N/A |
| Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While decompressing a PCOMPRESS1 stream, the 32-bit compressed-block-size field of the first block (compsize) is read directly from the archive and used without validation as the length of a blockread into the fixed-size global buffers wbuf1/wbuf2 (1,114,112 bytes) and as the bound of the subsequent copy loop. The existing check "compsize > WBUFSIZE" is applied only to the size of each following block, so the first block escapes it; the same unvalidated value is also used to index wbuf1[compsize], an out-of-bounds read at an attacker-chosen offset. The copy loop additionally copies the requested length instead of the number of bytes actually read, and terminates on equality rather than on an upper bound. Because the project is built without range checking and no archive password, integrity tag or non-default configuration is required, the overflow overwrites adjacent global data; code execution was demonstrated by two independent researchers against the official Linux x86-64 and Windows x64 builds, and the denial-of-service and memory-corruption primitive is cross-platform (Windows, macOS, Linux, BSD). | ||||
| CVE-2026-65640 | 1 Wordpress | 1 Wordpress | 2026-10-01 | N/A |
| WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. | ||||
| CVE-2026-88467 | 2026-10-01 | 6.2 Medium | ||
| CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information. | ||||
| CVE-2026-51883 | 1 Chatchat-space | 1 Langchain-chatchat | 2026-10-01 | N/A |
| The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory. | ||||
| CVE-2026-51886 | 2026-10-01 | N/A | ||
| langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls. | ||||
| CVE-2026-51895 | 1 Infiniflow | 1 Ragflow | 2026-10-01 | N/A |
| Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations. | ||||
| CVE-2026-71452 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-01 | N/A |
| - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-71448 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-01 | N/A |
| : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-64893 | 1 Johnson Controls | 1 Easyio Neo | 2026-10-01 | N/A |
| - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25. | ||||
| CVE-2026-86345 | 1 Redhat | 2 Directory Server, Enterprise Linux | 2026-10-01 | 9 Critical |
| A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful. | ||||
| CVE-2026-16529 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Openshift and 6 more | 2026-10-01 | 7.5 High |
| A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads. | ||||
| CVE-2026-16527 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Openshift and 6 more | 2026-10-01 | 7.3 High |
| An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. | ||||
| CVE-2026-16526 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Openshift and 6 more | 2026-10-01 | 8.8 High |
| A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. | ||||
| CVE-2026-16524 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Openshift and 6 more | 2026-10-01 | 7.8 High |
| A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. | ||||
| CVE-2026-15816 | 1 Redhat | 12 Enterprise Linux, Enterprise Linux Eus, Hardened Images and 9 more | 2026-10-01 | 7.5 High |
| A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling. | ||||