Export limit exceeded: 414885 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414885 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79678 | 1 Redhat | 8 Enterprise Linux, Enterprise Linux Eus, Freeipa and 5 more | 2026-10-26 | 8.1 High |
| A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion. | ||||
| CVE-2026-76578 | 1 Redhat | 8 Enterprise Linux, Enterprise Linux Eus, Freeipa and 5 more | 2026-10-26 | 9.8 Critical |
| A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. | ||||
| CVE-2026-73198 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 7.5 High |
| A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition. | ||||
| CVE-2026-73197 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 7.5 High |
| A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service. | ||||
| CVE-2026-19550 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 8.2 High |
| A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory. | ||||
| CVE-2026-18147 | 1 Redhat | 8 Enterprise Linux, Enterprise Linux Eus, Freeipa and 5 more | 2026-10-26 | 8.1 High |
| A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted. | ||||
| CVE-2026-13097 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 8.7 High |
| A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise. | ||||
| CVE-2026-83596 | 1 Redhat | 2 Enterprise Linux, Rhel Eus | 2026-10-26 | 8.8 High |
| A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | ||||
| CVE-2026-78376 | 1 Redhat | 2 Enterprise Linux, Rhel Eus | 2026-10-26 | 8.8 High |
| A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. | ||||
| CVE-2026-74041 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-26 | 7.2 High |
| Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload. | ||||
| CVE-2026-83931 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-26 | 7.8 High |
| Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | ||||
| CVE-2026-83932 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 7.8 High |
| Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-116216 | 2026-10-26 | 5.3 Medium | ||
| MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them. | ||||
| CVE-2026-116215 | 2026-10-26 | 3.1 Low | ||
| MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content. | ||||
| CVE-2026-116214 | 2026-10-26 | 9.1 Critical | ||
| MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account. | ||||
| CVE-2026-110285 | 2026-10-26 | 5.3 Medium | ||
| The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying. | ||||
| CVE-2026-111980 | 1 Wordpress-extensions | 1 Givewp | 2026-10-26 | 5.5 Medium |
| The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators. | ||||
| CVE-2026-114742 | 2026-10-26 | 2.7 Low | ||
| The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users. | ||||
| CVE-2026-114743 | 2026-10-26 | 3.1 Low | ||
| The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default. | ||||
| CVE-2026-115214 | 2026-10-26 | 9.8 Critical | ||
| The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator. | ||||