Export limit exceeded: 412577 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412577 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107928 | 1 Curl | 1 Curl | 2026-10-20 | 4.8 Medium |
| When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send. | ||||
| CVE-2026-105960 | 2026-10-20 | 5.5 Medium | ||
| PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. | ||||
| CVE-2026-94131 | 2 Acymailing, Acymailing.com | 2 Acymailing, Acymailing.com Acymailing Extension For Joomla | 2026-10-20 | 8.1 High |
| Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php. | ||||
| CVE-2026-94266 | 1 Curl | 1 Curl | 2026-10-20 | 3.3 Low |
| libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. | ||||
| CVE-2026-110322 | 2026-10-20 | 5.5 Medium | ||
| The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing. | ||||
| CVE-2026-94265 | 1 Curl | 1 Curl | 2026-10-20 | 3.1 Low |
| When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`. | ||||
| CVE-2026-94132 | 2 Acymailing, Acymailing.com | 2 Acymailing, Acymailing.com Acymailing Extension For Joomla | 2026-10-20 | 8.1 High |
| Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root. | ||||
| CVE-2026-35499 | 2026-10-20 | 9.1 Critical | ||
| An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-9660 | 2026-10-20 | 9.1 Critical | ||
| Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter. | ||||
| CVE-2026-9814 | 2026-10-20 | 9.1 Critical | ||
| An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-9827 | 2026-10-20 | 9.1 Critical | ||
| A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-9869 | 2026-10-20 | 9.1 Critical | ||
| A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-10138 | 2026-10-20 | 9.1 Critical | ||
| A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | ||||
| CVE-2026-92391 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process. | ||||
| CVE-2026-103672 | 2026-10-20 | 7.1 High | ||
| The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. | ||||
| CVE-2026-92390 | 1 Curl | 1 Curl | 2026-10-20 | 6.5 Medium |
| When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint. | ||||
| CVE-2026-92389 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle. | ||||
| CVE-2026-92388 | 1 Curl | 1 Curl | 2026-10-20 | 6.5 Medium |
| When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer. | ||||
| CVE-2026-97160 | 2 Lomart, Lomart.fr | 2 Up, Up Plugin For Joomla | 2026-10-20 | 8.8 High |
| Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | ||||
| CVE-2026-92387 | 1 Curl | 1 Curl | 2026-10-20 | 3.7 Low |
| By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle. | ||||