Export limit exceeded: 418541 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418541 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87085 | 1 Tanium | 1 Provision | 2026-10-28 | 6.5 Medium |
| Tanium addressed a SQL injection vulnerability in Provision. | ||||
| CVE-2026-108307 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Index-cx | 2026-10-28 | 7.8 High |
| Tanium addressed a heap-based buffer overflow vulnerability in Index. | ||||
| CVE-2026-108326 | 1 Tanium | 2 Cx-stream, Endpoint Configuration Toolset Solution | 2026-10-28 | 6.5 Medium |
| Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. | ||||
| CVE-2026-87086 | 1 Tanium | 1 Provision | 2026-10-28 | 7.5 High |
| Tanium addressed a denial of service vulnerability in Provision. | ||||
| CVE-2026-108303 | 1 Tanium | 1 Certificate Manager | 2026-10-28 | 8.8 High |
| Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. | ||||
| CVE-2026-118170 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-10-28 | N/A |
| The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document. | ||||
| CVE-2026-118172 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-10-28 | N/A |
| The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller. | ||||
| CVE-2026-118171 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-10-28 | N/A |
| The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions. | ||||
| CVE-2026-112352 | 1 Sunhillo | 1 Sureline | 2026-10-28 | 9.1 Critical |
| Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution. | ||||
| CVE-2026-78661 | 1 Golang | 1 Net | 2026-10-28 | N/A |
| When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. | ||||
| CVE-2026-97045 | 1 Golang | 1 Net | 2026-10-28 | N/A |
| In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. | ||||
| CVE-2026-50571 | 1 W3c | 1 Websub | 2026-10-28 | 5.7 Medium |
| WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site. | ||||
| CVE-2014-125136 | 1 C97 | 3 Cart Engine, Kemana Directory, Qengine Cms | 2026-10-28 | 5.9 Medium |
| C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes. | ||||
| CVE-2014-125137 | 1 C97 | 3 Cart Engine, Kemana Directory, Qengine Cms | 2026-10-28 | 6.5 Medium |
| C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server. | ||||
| CVE-2026-118377 | 1 Mewebstudio | 1 Pos | 2026-10-28 | 7.5 High |
| mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying. | ||||
| CVE-2026-104383 | 1 Eaglecloud | 1 Aquila | 2026-10-28 | N/A |
| Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection | ||||
| CVE-2026-104384 | 1 Eaglecloud | 1 Aquila | 2026-10-28 | N/A |
| Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets | ||||
| CVE-2026-115522 | 1 Google | 1 Agent Development Kit (adk) For Python | 2026-10-28 | 5.4 Medium |
| Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping. | ||||
| CVE-2026-103996 | 2 Ifso, Wordpress-extensions | 2 If-so Dynamic Content – Elementor & All Page Builders Personalization, If-so Dynamic Content | 2026-10-28 | 6.4 Medium |
| The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode. | ||||
| CVE-2026-118164 | 2 Ifso, Wordpress-extensions | 2 If-so Dynamic Content – Elementor & All Page Builders Personalization, If-so Dynamic Content | 2026-10-28 | 6.4 Medium |
| The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||