Export limit exceeded: 424931 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424931 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424931 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424931 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125398 | 1 Corebunch | 1 Instatic | 2026-11-10 | 7.1 High |
| Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors. | ||||
| CVE-2026-125406 | 2 Ettercap, Ettercap-project | 2 Ettercap, Ettercap | 2026-11-10 | 8.8 High |
| Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root. | ||||
| CVE-2026-125383 | 1 Go2ismail | 1 Asp.net-core-inventory-order-management-system | 2026-11-10 | 9.8 Critical |
| INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API. | ||||
| CVE-2026-125385 | 1 Go2ismail | 1 Asp.net-core-inventory-order-management-system | 2026-11-10 | 6.5 Medium |
| INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json. | ||||
| CVE-2026-125397 | 1 Nocobase | 1 Nocobase | 2026-11-10 | 7.1 High |
| NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration. | ||||
| CVE-2026-125087 | 1 Michael-a-kuykendall | 1 Shimmy | 2026-11-10 | 7.3 High |
| A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component. | ||||
| CVE-2026-123439 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123438 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123437 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123435 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123432 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123431 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123430 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123429 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123427 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123426 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123425 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123424 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-125086 | 1 D-link | 1 M60 | 2026-11-10 | 10 Critical |
| A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-125205 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-10 | 5.5 Medium |
| FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service. | ||||