Export limit exceeded: 420380 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94441 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77372 | 1 Veracrypt | 1 Veracrypt | 2026-11-05 | 7.8 High |
| VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the unprivileged GUI or CLI to the root CoreService helper. Serializer::DeserializeWString allocates floor(size / sizeof(wchar_t)) elements but reads size bytes, so a non-aligned size can overflow the heap allocation. VolumePassword::Deserialize accepts PasswordSize values larger than the fixed 128-byte PasswordBuffer, allowing downstream DataPtr() and Size() consumers such as the KDF to read beyond the buffer. DeserializeString, DeserializeWString, and the string and wide-string list readers also lack allocation and collection bounds, which can exhaust memory, and a zero-length DeserializeString can access an empty vector. Windows uses a different path, and the immediate CoreService pipe writer is the same-user parent process, so the documented exposure is a local defense-in-depth boundary rather than a remote attack. This issue is fixed in 1.26.30. | ||||
| CVE-2026-38595 | 2026-11-05 | 9.8 Critical | ||
| An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint. | ||||
| CVE-2026-97185 | 2 Gimp, Redhat | 4 Gimp, Enterprise Linux, Rhel E4s and 1 more | 2026-11-05 | 7.8 High |
| A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution. | ||||
| CVE-2026-91149 | 1 Redhat | 4 Enterprise Linux, Openshift Dev Spaces, Openshift Devspaces and 1 more | 2026-11-05 | 7.5 High |
| A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users. | ||||
| CVE-2026-90949 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-05 | 7.8 High |
| A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution. | ||||
| CVE-2026-90948 | 1 Redhat | 3 Enterprise Linux, Rhel E4s, Rhel Els | 2026-11-05 | 7.8 High |
| A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash. | ||||
| CVE-2026-90947 | 1 Redhat | 3 Enterprise Linux, Rhel E4s, Rhel Els | 2026-11-05 | 7.8 High |
| A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution. | ||||
| CVE-2026-9064 | 1 Redhat | 12 389 Directory Server, Directory Server, Directory Server E4s and 9 more | 2026-11-05 | 7.5 High |
| A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service. | ||||
| CVE-2026-108949 | 1 Apache | 2 Activemq, Activemq Broker | 2026-11-05 | 6.5 Medium |
| Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue. | ||||
| CVE-2026-86565 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more | 2026-11-04 | 8.2 High |
| A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. | ||||
| CVE-2026-86476 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-04 | 8.4 High |
| A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process. | ||||
| CVE-2026-121748 | 1 Nvm-sh | 1 Nvm | 2026-11-04 | 3.6 Low |
| Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm config delete prefix` and `npm config delete globalconfig` in the current directory without naming a config file. npm loads the project `.npmrc` before deciding which file to edit, so that file chooses the target: `userconfig=~/.bashrc` makes npm rewrite `~/.bashrc` as ini (corrupting it), and `location=global` with `globalconfig=` leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project `.npmrc` select which config file `--delete-prefix` edits. | ||||
| CVE-2026-108387 | 2 Radare, Radareorg | 2 Radare2, Radare2 | 2026-11-04 | 7.8 High |
| radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2. | ||||
| CVE-2026-81627 | 2 Qemu, Redhat | 9 Qemu, Enterprise Linux, Enterprise Linux For Nvidia 26 and 6 more | 2026-11-04 | 8.2 High |
| A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. | ||||
| CVE-2026-81624 | 1 Redhat | 9 Build Of Apache Camel For Spring Boot, Camel Spring Boot, Enterprise Linux and 6 more | 2026-11-04 | 7.5 High |
| Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources. | ||||
| CVE-2026-79992 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-04 | 7.8 High |
| A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution. | ||||
| CVE-2026-76561 | 1 Redhat | 9 Certificate System, Enterprise Linux, Enterprise Linux Eus and 6 more | 2026-11-04 | 7.2 High |
| A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account. | ||||
| CVE-2026-122050 | 1 Campcodes | 1 Complete Sales And Inventory System With Credit Management | 2026-11-04 | 7.3 High |
| A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-61626 | 1 Libass | 1 Libass | 2026-11-04 | N/A |
| libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream loaded through `ass_process_chunk`, enabled read-order checking, and later pruning of the malicious events. Read-order checking is enabled by default unless `ass_set_check_readorder` is called with zero; pruning must occur explicitly through `ass_prune_events` or through automatic pruning previously enabled with `ass_configure_prune`. On common systems with arithmetic right shift, 32-bit int values, the upper address region reserved to the kernel, and matching binary/kernel architecture, the expected consequence is denial of service. More extensive exploitation on uncommon systems is theoretical and strongly constrained by the target addresses, bit-clearing-only mutation, and ASLR. This issue is fixed in version 0.17.5. | ||||
| CVE-2026-45144 | 1 Chamilo | 1 Chamilo Lms | 2026-11-04 | 8.9 High |
| Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside `{% autoescape false %}`, without server-side sanitization on the write path. A ROLE_STUDENT attacker can plant HTML in their own profile; self-registration, when enabled, lets an otherwise anonymous attacker obtain that role. The stored content executes in the browser of any visitor, including administrators, who follows the public profile link, potentially allowing account takeover through session, JWT, or `localStorage` exfiltration. This issue is fixed in version 2.0.1. | ||||