Export limit exceeded: 10913 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413536 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-101796 | 1 Oracle | 2 Mysql Cluster, Mysql Server | 2026-10-23 | 7.5 High |
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-79846 | 2026-10-23 | 10 Critical | ||
| No description provided | ||||
| CVE-2026-79852 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79853 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79872 | 2026-10-23 | 9.4 Critical | ||
| No description provided | ||||
| CVE-2026-79877 | 2026-10-23 | 8.8 High | ||
| No description provided | ||||
| CVE-2026-79880 | 2026-10-23 | 8.7 High | ||
| No description provided | ||||
| CVE-2026-114647 | 1 Mongodb | 1 C# Driver | 2026-10-23 | 4.3 Medium |
| The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend. | ||||
| CVE-2026-114649 | 1 Mongodb | 1 C# Driver | 2026-10-23 | 6.8 Medium |
| The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access. | ||||
| CVE-2026-114654 | 1 Mongodb | 1 C# Driver | 2026-10-23 | 6.5 Medium |
| A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated. | ||||
| CVE-2026-115398 | 2 Nationalsecurityagency, Nsa | 2 Ghidra, Ghidra | 2026-10-23 | 5.5 Medium |
| Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session. | ||||
| CVE-2026-115503 | 2 Nationalsecurityagency, Nsa | 2 Ghidra, Ghidra | 2026-10-23 | 5.5 Medium |
| Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail. | ||||
| CVE-2026-115504 | 1 Heasarc | 1 Cfitsio | 2026-10-23 | 7.8 High |
| CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution. | ||||
| CVE-2026-115508 | 1 Unclecode | 1 Crawl4ai | 2026-10-23 | 6.5 Medium |
| Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health. | ||||
| CVE-2026-114615 | 1 Authlib | 1 Authlib | 2026-10-23 | 7.4 High |
| Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0. | ||||
| CVE-2026-111100 | 1 Kiloview | 1 E3 Firmware | 2026-10-23 | 5.3 Medium |
| The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks. | ||||
| CVE-2026-109198 | 2026-10-23 | 7.2 High | ||
| The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow. | ||||
| CVE-2026-115497 | 2026-10-23 | 7.5 High | ||
| The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link. | ||||
| CVE-2026-79855 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79859 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||