Export limit exceeded: 419348 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94257 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16305 | 1 Infinitt Healthcare | 1 System Manager | 2026-11-03 | N/A |
| Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates. | ||||
| CVE-2025-12544 | 1 Wso2 | 3 Api Manager, Wso2 Api Manager, Wso2 Carbon Api Manager Publisher Rest Api | 2026-11-03 | 4.8 Medium |
| The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking. | ||||
| CVE-2026-111560 | 1 Barracuda Networks | 6 Barracuda Email Security Gateway, Barracuda Load Balancer Application Delivery Controller, Barracuda Message Archiver and 3 more | 2026-11-03 | N/A |
| Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. | ||||
| CVE-2026-105601 | 1 Php-web-design.com | 1 Stageit Extension For Joomla | 2026-11-03 | N/A |
| Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5 | ||||
| CVE-2026-121588 | 2026-11-03 | 6.1 Medium | ||
| TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials. | ||||
| CVE-2026-120428 | 1 Chaitin | 1 Pandawiki | 2026-11-03 | 6.1 Medium |
| PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover. | ||||
| CVE-2026-120440 | 2 Quickjs-ng, Quickjs Project | 2 Quickjs, Quickjs | 2026-11-03 | 5.3 Medium |
| QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service. | ||||
| CVE-2026-120443 | 1 Sea-team | 1 Gofound | 2026-11-03 | 6.1 Medium |
| GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document. | ||||
| CVE-2026-120455 | 1 Biojppm | 1 Rapidyaml | 2026-11-03 | 6.1 Medium |
| rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process. | ||||
| CVE-2026-2102 | 1 Wren Security | 1 Wrensec-commons | 2026-11-03 | 6.1 Medium |
| wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0. | ||||
| CVE-2026-120500 | 1 Redimp | 1 Otterwiki | 2026-11-03 | 6.1 Medium |
| An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page. | ||||
| CVE-2026-16306 | 1 Infinitt Healthcare | 1 System Manager | 2026-11-03 | N/A |
| Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters. | ||||
| CVE-2026-119735 | 1 Petpooja | 1 Munshi | 2026-11-03 | 5.4 Medium |
| Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened. | ||||
| CVE-2026-119742 | 1 Nagios | 1 Nagios Xi | 2026-11-03 | 7.2 High |
| Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user. | ||||
| CVE-2026-119724 | 1 Apache | 1 Jclouds | 2026-11-03 | N/A |
| ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-112351 | 1 Sunhillo | 1 Sureline | 2026-11-03 | 8.8 High |
| Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise. | ||||
| CVE-2026-77691 | 1 Zohocorp | 1 Manageengine Key Manager Plus | 2026-11-03 | 8.1 High |
| ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA | ||||
| CVE-2026-119124 | 1 Imagemagick | 1 Imagemagick | 2026-11-03 | 3.3 Low |
| ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application. | ||||
| CVE-2026-119051 | 1 Flat Project | 1 Flat | 2026-11-03 | 5.9 Medium |
| flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop. | ||||
| CVE-2026-119025 | 2026-11-03 | 7.5 High | ||
| open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand. | ||||