Export limit exceeded: 29862 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (29862 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119270 | 1 Google | 1 Chrome | 2026-10-31 | 8.8 High |
| Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-63339 | 1 Inex | 1 Ixp Manager | 2026-10-30 | 8.8 High |
| IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0. | ||||
| CVE-2026-62979 | 1 Roziscoding | 1 Jack | 2026-10-30 | N/A |
| jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0. | ||||
| CVE-2026-119339 | 2026-10-30 | 5.5 Medium | ||
| Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4. | ||||
| CVE-2026-119331 | 1 Ladybirdbrowser | 1 Ladybird | 2026-10-30 | 7.1 High |
| Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91. | ||||
| CVE-2026-118537 | 2 A2ui, A2ui-project | 2 A2ui, A2ui | 2026-10-30 | 4.3 Medium |
| A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-114270 | 1 Wordpress-extensions | 1 Geodirectory | 2026-10-30 | 5.3 Medium |
| The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password. | ||||
| CVE-2026-113693 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-30 | N/A |
| Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value. | ||||
| CVE-2026-87941 | 1 Drupal | 1 Patreon | 2026-10-30 | 5.9 Medium |
| Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | ||||
| CVE-2026-79876 | 1 Hpe | 1 Aos | 2026-10-30 | 9.3 Critical |
| A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service. | ||||
| CVE-2026-118563 | 1 Drupal | 1 Cacheflush | 2026-10-30 | N/A |
| Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*. | ||||
| CVE-2026-107268 | 1 Drupal | 1 Two Factor Authentication - Tfa / Passwordless Login | 2026-10-30 | 4.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. | ||||
| CVE-2026-62264 | 1 Sylphxai | 1 Pdf-reader-mcp | 2026-10-30 | 7.5 High |
| PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1. | ||||
| CVE-2026-59978 | 1 Adminneo-org | 1 Adminneo | 2026-10-30 | 7.5 High |
| AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0. | ||||
| CVE-2026-61618 | 1 Axiom-crypto | 1 Snark-verifier | 2026-10-30 | N/A |
| SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5. | ||||
| CVE-2026-62860 | 1 Zoeille | 1 Picsou-finance | 2026-10-30 | 5.3 Medium |
| Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8. | ||||
| CVE-2026-86959 | 1 Apple | 2 Ios And Ipados, Macos | 2026-10-30 | 4.3 Medium |
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination. | ||||
| CVE-2026-109763 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-30 | 5.4 Medium |
| Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-62335 | 1 Openvm-org | 1 Openvm | 2026-10-30 | N/A |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` accepts `appExeCommit` and `appVmCommit` as `bytes32` values without checking that either is less than the `BN254` scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. | ||||
| CVE-2026-62333 | 1 Openvm-org | 1 Openvm | 2026-10-30 | N/A |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. | ||||