Export limit exceeded: 420487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420487 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120474 | 1 Undici | 1 Undici | 2026-11-06 | 6.5 Medium |
| undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. | ||||
| CVE-2026-120222 | 1 Undici | 1 Undici | 2026-11-06 | 5.9 Medium |
| undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading. | ||||
| CVE-2026-116592 | 1 Undici | 1 Undici | 2026-11-06 | 7.4 High |
| undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests. | ||||
| CVE-2026-120423 | 1 Undici | 1 Undici | 2026-11-06 | 5.9 Medium |
| undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts the response, so a server returning a body different from the pinned digest passes the check. An application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-controlled bytes with no integrity error, and the attacker needs only to control the response body, not the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests. | ||||
| CVE-2026-120415 | 1 Undici | 1 Undici | 2026-11-06 | 5.9 Medium |
| undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied as an array of name and value tuples (a valid documented input, for example from Object.entries), the redirect handler misreads them as a flat list so the header names never match and the sensitive headers are not removed. If a header-normalizing interceptor such as cache or deduplicate is composed outside the redirect interceptor, it then serializes the retained headers onto the cross-origin request, disclosing the caller's origin-bound credentials to the unrelated redirect destination. This is a representation-dependent bypass of the cross-origin header stripping added in CVE-2024-30260. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply request headers as a plain object or a flat name and value array rather than an array of tuples, or compose the redirect interceptor outside the normalizing interceptor. | ||||
| CVE-2026-123279 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 9 Critical |
| In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators | ||||
| CVE-2026-123280 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 8.1 High |
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports | ||||
| CVE-2026-123282 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 7.4 High |
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session | ||||
| CVE-2026-123283 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 6.8 Medium |
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account | ||||
| CVE-2026-123284 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 6.5 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content | ||||
| CVE-2026-123285 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 6.3 Medium |
| In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection | ||||
| CVE-2026-123286 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.9 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token | ||||
| CVE-2026-123287 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.9 Medium |
| In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports | ||||
| CVE-2026-88799 | 2026-11-06 | 8.8 High | ||
| The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover. | ||||
| CVE-2026-85108 | 2026-11-06 | N/A | ||
| Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and providing better defaults. | ||||
| CVE-2026-123313 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 3.3 Low |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings | ||||
| CVE-2026-123314 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 3.1 Low |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request | ||||
| CVE-2026-123316 | 2026-11-06 | 5.5 Medium | ||
| In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs | ||||
| CVE-2026-123288 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.4 Medium |
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link | ||||
| CVE-2026-123289 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.4 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files | ||||