Export limit exceeded: 414181 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414181 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116060 | 1 Sourcecodester | 1 Performance Indicator System | 2026-10-25 | 7.3 High |
| A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-116061 | 1 Sourcecodester | 1 Performance Indicator System | 2026-10-25 | 7.3 High |
| A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-104286 | 1 Fortinet | 1 Fortimail | 2026-10-25 | 9.8 Critical |
| An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. | ||||
| CVE-2025-64393 | 1 Veeam | 1 Backup And Replication | 2026-10-25 | N/A |
| This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | ||||
| CVE-2026-110447 | 1 Collabora | 1 Collabora Online - Built-in Code Server | 2026-10-25 | N/A |
| Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. | ||||
| CVE-2026-105888 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-10-25 | 5.4 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||||
| CVE-2026-6243 | 2 Shabti, Wordpress-extensions | 2 Frontend Admin By Dynamapps, Frontend Admin By Dynamiapps | 2026-10-25 | 6.4 Medium |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-109194 | 2 Red Hat, Redhat | 3 Red Hat Quay 3, Quay, Red Hat Quay 3 | 2026-10-25 | 6.4 Medium |
| A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID). | ||||
| CVE-2026-70197 | 1 Microsoft | 18 .net, .net 10.0 Installed On Linux, .net 10.0 Installed On Mac Os and 15 more | 2026-10-25 | 8.1 High |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-116141 | 1 Imagemagick | 1 Imagemagick | 2026-10-25 | 5.3 Medium |
| ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption. | ||||
| CVE-2026-116150 | 1 Imagemagick | 1 Imagemagick | 2026-10-25 | 3.1 Low |
| ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service. | ||||
| CVE-2026-116156 | 1 Imagemagick | 1 Imagemagick | 2026-10-25 | 3.3 Low |
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service. | ||||
| CVE-2026-116157 | 1 Imagemagick | 1 Imagemagick | 2026-10-25 | 3.3 Low |
| ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service. | ||||
| CVE-2026-100517 | 2 Villatheme, Wordpress-extensions | 2 Photo Reviews For Woocommerce, Photo Reviews For Woocommerce | 2026-10-25 | 7.5 High |
| Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions. | ||||
| CVE-2025-43300 | 1 Apple | 7 Ios, Ipados, Iphone Os and 4 more | 2026-10-25 | 10 Critical |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. | ||||
| CVE-2026-116058 | 1 Alfresco | 1 Activiti | 2026-10-25 | 6.3 Medium |
| A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-116057 | 1 Kodcloud | 1 Kodexplorer | 2026-10-25 | 6.3 Medium |
| A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-116056 | 1 Kodcloud | 1 Kodexplorer | 2026-10-25 | 6.3 Medium |
| A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-116137 | 2 Adm-zip Project, Cthackers | 2 Adm-zip, Adm-zip | 2026-10-25 | 3.7 Low |
| adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks. | ||||
| CVE-2026-97302 | 2 Themeisle, Wordpress-extensions | 2 Mpg, Mpg | 2026-10-25 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. | ||||