Export limit exceeded: 50725 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (50725 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-24081 | 2026-09-17 | 7.4 High | ||
| Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. | ||||
| CVE-2026-69443 | 1 Microsoft | 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more | 2026-09-17 | 7.5 High |
| Out-of-bounds read in Windows Device Health Attestation (DHA) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-92880 | 1 Vgmstream | 1 Vgmstream | 2026-09-17 | 6.3 Medium |
| A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue. | ||||
| CVE-2026-69572 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-17 | 5.7 Medium |
| Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-76797 | 1 Mongodb | 2 Bi Connector Transition Readiness Report, Mongosql Transition Readiness Tool | 2026-09-17 | 6.3 Medium |
| The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required. | ||||
| CVE-2026-69267 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-09-17 | 6.5 Medium |
| Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-91103 | 1 Hp Inc. | 1 Hp Linux Imaging And Printing Software Hplip | 2026-09-17 | 6.3 Medium |
| HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. | ||||
| CVE-2026-91101 | 1 Hp Inc. | 1 Hp Linux Imaging And Printing Software Hplip | 2026-09-17 | 4.6 Medium |
| HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. | ||||
| CVE-2026-91090 | 1 Gpac | 1 Gpac | 2026-09-17 | 3.9 Low |
| A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded. | ||||
| CVE-2026-85469 | 1 Redhat | 1 Quay | 2026-09-17 | 8 High |
| A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise. | ||||
| CVE-2026-81546 | 1 Canva | 1 Affinity | 2026-09-17 | 7.7 High |
| The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in arbitrary code execution. | ||||
| CVE-2026-57138 | 1 Mervinpraison | 1 Praisonai | 2026-09-17 | 9.9 Critical |
| PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2. | ||||
| CVE-2026-46623 | 1 Openidentityplatform | 1 Openam | 2026-09-17 | N/A |
| Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1. | ||||
| CVE-2025-10881 | 1 Autodesk | 16 3ds Max, Advance Steel, Autocad and 13 more | 2026-09-17 | 7.8 High |
| A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | ||||
| CVE-2026-11803 | 1 Autodesk | 3 Autocad, Autocad Lt, Revit | 2026-09-17 | 7.8 High |
| A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | ||||
| CVE-2026-18917 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Enterprise Linux Nvidia and 6 more | 2026-09-17 | 7.8 High |
| A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. | ||||
| CVE-2026-91843 | 1 Checkpoint | 1 Quantum Security Management | 2026-09-17 | 9.8 Critical |
| A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. | ||||
| CVE-2026-91106 | 1 Hp Inc. | 1 Hp Linux Imaging And Printing Software Hplip | 2026-09-17 | N/A |
| HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. | ||||
| CVE-2026-91105 | 1 Hp Inc. | 1 Hp Linux Imaging And Printing Software Hplip | 2026-09-17 | 8.8 High |
| HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. | ||||
| CVE-2026-5946 | 2 Isc, Redhat | 3 Bind, Bind 9, Hummingbird | 2026-09-17 | 7.5 High |
| Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. | ||||