Export limit exceeded: 414481 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414481 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414481 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-83929 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-26 | 8.8 High |
| Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-83930 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-26 | 7 High |
| Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-79678 | 1 Redhat | 8 Enterprise Linux, Enterprise Linux Eus, Freeipa and 5 more | 2026-10-26 | 8.1 High |
| A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion. | ||||
| CVE-2026-76578 | 1 Redhat | 8 Enterprise Linux, Enterprise Linux Eus, Freeipa and 5 more | 2026-10-26 | 9.8 Critical |
| A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. | ||||
| CVE-2026-73198 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 7.5 High |
| A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition. | ||||
| CVE-2026-73197 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 7.5 High |
| A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service. | ||||
| CVE-2026-19550 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 8.2 High |
| A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory. | ||||
| CVE-2026-18147 | 1 Redhat | 8 Enterprise Linux, Enterprise Linux Eus, Freeipa and 5 more | 2026-10-26 | 8.1 High |
| A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted. | ||||
| CVE-2026-13097 | 2 Freeipa, Redhat | 8 Freeipa, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-10-26 | 8.7 High |
| A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise. | ||||
| CVE-2026-83596 | 1 Redhat | 2 Enterprise Linux, Rhel Eus | 2026-10-26 | 8.8 High |
| A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | ||||
| CVE-2026-78376 | 1 Redhat | 2 Enterprise Linux, Rhel Eus | 2026-10-26 | 8.8 High |
| A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. | ||||
| CVE-2026-74041 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-26 | 7.2 High |
| Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload. | ||||
| CVE-2026-83931 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-26 | 7.8 High |
| Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | ||||
| CVE-2026-83932 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 7.8 High |
| Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-116488 | 2026-10-26 | 6.8 Medium | ||
| NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service. | ||||
| CVE-2026-116487 | 2026-10-26 | 4.6 Medium | ||
| NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory. | ||||
| CVE-2026-116485 | 2026-10-26 | 9.8 Critical | ||
| danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment. | ||||
| CVE-2026-116219 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-10-26 | 7.2 High |
| Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user. | ||||
| CVE-2026-116218 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-10-26 | 7.6 High |
| Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries. | ||||
| CVE-2026-116216 | 2026-10-26 | 5.3 Medium | ||
| MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them. | ||||