Export limit exceeded: 405701 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 405701 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405701 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108162 | 1 Smp46 | 1 Pingvin-share-x | 2026-10-13 | 6.5 Medium |
| Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses. | ||||
| CVE-2026-108115 | 1 Kortix-ai | 1 Suna | 2026-10-13 | 4.9 Medium |
| Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses. | ||||
| CVE-2026-107856 | 1 Civiform | 1 Civiform | 2026-10-13 | 4.5 Medium |
| CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0. | ||||
| CVE-2026-107848 | 1 Contao | 1 Contao | 2026-10-13 | 3.5 Low |
| Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12. | ||||
| CVE-2026-105465 | 1 Ibm | 1 Db2 | 2026-10-13 | 8.8 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. | ||||
| CVE-2026-105464 | 1 Ibm | 1 Db2 | 2026-10-13 | 8.8 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management. | ||||
| CVE-2026-103903 | 1 Mikrotik | 1 Routeros | 2026-10-13 | 8.8 High |
| An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account. | ||||
| CVE-2026-109976 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-10-13 | 4.7 Medium |
| A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot. | ||||
| CVE-2026-75025 | 1 Mattermost | 2 Mattermost, Mattermost Desktop | 2026-10-13 | 4.7 Medium |
| Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy. Mattermost Advisory ID: MMSA-2026-00698 | ||||
| CVE-2026-12284 | 1 Mattermost | 2 Mattermost, Mattermost Desktop | 2026-10-13 | 3.8 Low |
| Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699 | ||||
| CVE-2026-75588 | 1 Mattermost | 2 Mattermost, Mattermost Desktop | 2026-10-13 | 2.6 Low |
| Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717 | ||||
| CVE-2026-102110 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-13 | 5.9 Medium |
| An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disrupt setup and leave the appliance in an incompletely configured state. The issue is only reachable while an appliance is being activated for the first time and not yet fully configured. | ||||
| CVE-2026-109833 | 1 Redhat | 1 Enterprise Linux | 2026-10-13 | 5.9 Medium |
| A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service. | ||||
| CVE-2026-102117 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-13 | 7.2 High |
| On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account. | ||||
| CVE-2026-102119 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-13 | 7.2 High |
| A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system. | ||||
| CVE-2026-109403 | 1 Conductor-oss | 1 Conductor | 2026-10-13 | 7.3 High |
| A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-102136 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-13 | 6.3 Medium |
| In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node. | ||||
| CVE-2026-102137 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-13 | 4.1 Medium |
| An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file. | ||||
| CVE-2026-102138 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-13 | 3.3 Low |
| An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active. | ||||
| CVE-2026-102140 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-13 | 4.9 Medium |
| An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data. | ||||