Export limit exceeded: 417539 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417539 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-45049 | 1 Openidentityplatform | 1 Openam | 2026-10-29 | 8.3 High |
| Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1. | ||||
| CVE-2026-119285 | 1 Gofiber | 1 Fiber | 2026-10-29 | 5.9 Medium |
| Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3. | ||||
| CVE-2026-113399 | 1 Mozilla | 1 Firefox | 2026-10-29 | 9.8 Critical |
| Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | ||||
| CVE-2026-97406 | 1 Xerj | 1 Console Api | 2026-10-29 | 9.1 Critical |
| XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials. | ||||
| CVE-2026-60874 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-29 | 4.2 Medium |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L). | ||||
| CVE-2026-112658 | 1 Apple | 2 Ios And Ipados, Macos | 2026-10-29 | 5.5 Medium |
| This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-112609 | 1 Apple | 1 Ios And Ipados | 2026-10-29 | 5.5 Medium |
| This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-86925 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-29 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-48884 | 2 Wedevs, Wordpress-extensions | 2 Wp User Frontend, Wp User Frontend | 2026-10-29 | 5.3 Medium |
| Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13. | ||||
| CVE-2026-89058 | 1 Redhat | 22 Apicurio Registry, Build Keycloak, Build Of Apache Camel For Quarkus and 19 more | 2026-10-29 | 7.4 High |
| A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality. | ||||
| CVE-2024-9355 | 1 Redhat | 26 Amq Streams, Ansible Automation Platform, Container Native Virtualization and 23 more | 2026-10-29 | 6.5 Medium |
| A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. | ||||
| CVE-2026-96280 | 2 Flatpak, Redhat | 4 Flatpak, Enterprise Linux, Rhel E4s and 1 more | 2026-10-29 | 7.5 High |
| The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. | ||||
| CVE-2026-68562 | 1 Redhat | 2 Ansible Collection, Enterprise Linux | 2026-10-29 | 6.2 Medium |
| A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials. | ||||
| CVE-2026-110675 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-29 | 8.1 High |
| Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error. | ||||
| CVE-2026-107015 | 2026-10-29 | 9.1 Critical | ||
| Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. | ||||
| CVE-2026-107047 | 2026-10-29 | 7.5 High | ||
| Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data. | ||||
| CVE-2026-86868 | 1 Apple | 1 Macos | 2026-10-29 | 9.1 Critical |
| An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users. | ||||
| CVE-2026-86412 | 1 Curl | 1 Curl | 2026-10-29 | 8.1 High |
| A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains. | ||||
| CVE-2026-101421 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-29 | 7.5 High |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-87352 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-29 | 4.4 Medium |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). | ||||