Export limit exceeded: 18067 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18067 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117614 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 7.2 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. | ||||
| CVE-2026-79885 | 1 Hpe | 1 Aos | 2026-11-02 | 8.2 High |
| An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service. | ||||
| CVE-2026-79874 | 1 Hpe | 1 Aos | 2026-11-02 | 9.3 Critical |
| An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data. | ||||
| CVE-2026-79873 | 1 Hpe | 1 Aos | 2026-11-02 | 9.3 Critical |
| Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices. | ||||
| CVE-2026-20599 | 2 Mediatek, Mediatek, Inc. | 2 Mediatek Chipset, Mediatek Chipset | 2026-11-02 | 6.7 Medium |
| In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148. | ||||
| CVE-2026-120323 | 1 Samanhappy | 1 Mcphub | 2026-11-02 | 4.3 Medium |
| A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component. | ||||
| CVE-2026-120224 | 1 Oray | 1 Pugongying X5 Pro | 2026-11-02 | 9.9 Critical |
| A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-120192 | 1 Presenton | 1 Presenton | 2026-11-02 | 5.3 Medium |
| A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded. | ||||
| CVE-2026-115654 | 2026-11-02 | N/A | ||
| In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them. | ||||
| CVE-2026-117616 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.8 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution. | ||||
| CVE-2026-117619 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.1 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires. | ||||
| CVE-2026-117620 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.8 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords. | ||||
| CVE-2026-113914 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-02 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-117624 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.8 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects. | ||||
| CVE-2026-84605 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-02 | 3.3 Low |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to read the device's name. | ||||
| CVE-2026-84614 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-02 | 4.6 Medium |
| A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An attacker with physical access may be able to access contacts from the lock screen. | ||||
| CVE-2026-120447 | 2026-11-02 | 8.1 High | ||
| HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators. | ||||
| CVE-2026-79871 | 1 Hpe | 1 Aos | 2026-11-02 | 9.6 Critical |
| A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10. | ||||
| CVE-2026-79870 | 1 Hpe | 1 Aos | 2026-11-02 | 9.6 Critical |
| An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations. | ||||
| CVE-2026-79869 | 1 Hpe | 1 Aos | 2026-11-02 | 9.6 Critical |
| Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||