Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423974 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120647 | 2026-11-10 | 9.8 Critical | ||
| CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under. | ||||
| CVE-2026-125110 | 1 Rack | 1 Rack | 2026-11-10 | 5.3 Medium |
| Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific header_rules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8. | ||||
| CVE-2026-125173 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-10 | 5.5 Medium |
| FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application. | ||||
| CVE-2026-125111 | 1 Rack | 1 Rack | 2026-11-10 | 7.5 High |
| Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8. | ||||
| CVE-2026-125117 | 1 Automattic | 1 Mongoose | 2026-11-10 | 8.2 High |
| Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4. | ||||
| CVE-2026-125637 | 2026-11-10 | 7.2 High | ||
| A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting. | ||||
| CVE-2026-125077 | 1 Sourcecodester | 1 Smart Attendance System With Qr Code Scanner | 2026-11-09 | 4.3 Medium |
| A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-121173 | 1 Google | 1 Chrome | 2026-11-09 | 7.4 High |
| Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-125199 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-09 | 5.5 Medium |
| FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications. | ||||
| CVE-2026-63497 | 1 Titraio | 1 Titra | 2026-11-09 | N/A |
| titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches. | ||||
| CVE-2026-125076 | 1 Sourcecodester | 1 Smart Attendance System With Qr Code Scanner | 2026-11-09 | 7.3 High |
| A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-120632 | 2026-11-09 | 6.5 Medium | ||
| CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed. | ||||
| CVE-2026-120637 | 2026-11-09 | 9.8 Critical | ||
| CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments. | ||||
| CVE-2026-120645 | 2026-11-09 | 7.5 High | ||
| CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily. | ||||
| CVE-2026-112318 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-09 | 6.5 Medium |
| The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code. | ||||
| CVE-2026-102643 | 1 Ronf | 1 Asyncssh | 2026-11-09 | 8.8 High |
| AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1. | ||||
| CVE-2026-77473 | 1 Ronf | 1 Asyncssh | 2026-11-09 | 6.5 Medium |
| AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient._copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1. | ||||
| CVE-2026-125108 | 1 Rack | 1 Rack | 2026-11-09 | 3.7 Low |
| Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8. | ||||
| CVE-2026-125109 | 1 Rack | 1 Rack | 2026-11-09 | 4.8 Medium |
| Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8. | ||||
| CVE-2026-90587 | 1 Zephyrproject | 1 Zephyr | 2026-11-09 | 4.6 Medium |
| usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() — the only place udev->cfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev->cfg_desc remains NULL. usbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev->cfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer. The condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment. On targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental. | ||||