Export limit exceeded: 395549 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395549 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395549 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395549 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76154 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-09-18 | 7.3 High |
| A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin. | ||||
| CVE-2026-86049 | 1 Jupyter | 1 Jupyter Server | 2026-09-18 | 7.1 High |
| Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0. | ||||
| CVE-2026-93894 | 2026-09-18 | N/A | ||
| In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.). | ||||
| CVE-2026-93873 | 1 Cotonti | 1 Cotonti Siena | 2026-09-18 | 4.3 Medium |
| Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox. | ||||
| CVE-2026-93868 | 1 Cotonti | 1 Cotonti Siena | 2026-09-18 | 8.1 High |
| Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators. | ||||
| CVE-2026-93838 | 1 Lmsys | 1 Sglang | 2026-09-18 | 5.9 Medium |
| SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process. | ||||
| CVE-2026-93738 | 1 Totolink | 1 A3002mu | 2026-09-18 | 9.9 Critical |
| A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-93575 | 1 Redhat | 5 Amq Broker, Camel Spring Boot, Jboss Enterprise Application Platform and 2 more | 2026-09-18 | 7.5 High |
| A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError. | ||||
| CVE-2026-93574 | 1 Redhat | 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more | 2026-09-18 | 6.5 Medium |
| A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments. | ||||
| CVE-2026-93565 | 1 Redhat | 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more | 2026-09-18 | 7.5 High |
| A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems. | ||||
| CVE-2026-93563 | 1 Redhat | 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more | 2026-09-18 | 7.5 High |
| A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash. | ||||
| CVE-2026-93562 | 1 Redhat | 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more | 2026-09-18 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. | ||||
| CVE-2026-93561 | 1 Redhat | 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more | 2026-09-18 | 6.5 Medium |
| A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments. | ||||
| CVE-2026-93560 | 1 Redhat | 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more | 2026-09-18 | 7.5 High |
| A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources. | ||||
| CVE-2026-93491 | 1 Redhat | 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more | 2026-09-18 | 7.5 High |
| A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion. | ||||
| CVE-2026-92589 | 1 Craftcms | 1 Craft Cms | 2026-09-18 | 4.3 Medium |
| Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a `manageNestedElements::<ownerId>::field:<handle>` authorization flag for the entry's Matrix/Address fields. Unlike the corresponding delete endpoint, actions/nested-elements/reorder trusts this session flag alone and never rechecks the caller's save permission for the owner element. As a result, a view-only user can POST to actions/nested-elements/reorder using the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset parameters present in the read-only page source and rewrite the sort order of Matrix blocks or Addresses belonging to content they are explicitly denied save access to. | ||||
| CVE-2026-92579 | 2 Wordpress, Wwbn | 2 Wordpress, Avideo | 2026-09-18 | 5.4 Medium |
| In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials. | ||||
| CVE-2026-88097 | 1 Microsoft | 1 Edge Chromium | 2026-09-18 | 8.1 High |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-85272 | 2026-09-18 | 4.3 Medium | ||
| Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1. | ||||
| CVE-2026-85271 | 2026-09-18 | 6.1 Medium | ||
| Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1. | ||||