Export limit exceeded: 46017 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46017 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107350 | 1 Pgbouncer | 1 Pgbouncer | 2026-10-17 | 8.8 High |
| Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user. | ||||
| CVE-2026-107795 | 1 Tp-link | 1 Omada Software Controller | 2026-10-17 | N/A |
| Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access. | ||||
| CVE-2026-107348 | 1 Pgbouncer | 1 Pgbouncer | 2026-10-17 | 5.9 Medium |
| Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header. | ||||
| CVE-2026-107349 | 1 Pgbouncer | 1 Pgbouncer | 2026-10-17 | 7.5 High |
| An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted. | ||||
| CVE-2026-110216 | 1 Youlai | 1 Youlai-boot | 2026-10-17 | 7.1 High |
| youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/{userId}/status to disable root or admin accounts, locking administrators out, or re-enable accounts an administrator has disabled. | ||||
| CVE-2026-106090 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-10-17 | 8.8 High |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-106614 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-10-17 | 7.8 High |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-96847 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 7.8 High |
| Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-104141 | 1 Dataease | 1 Dataease | 2026-10-17 | N/A |
| DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action. | ||||
| CVE-2026-104142 | 1 Dataease | 1 Dataease | 2026-10-17 | N/A |
| DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26. | ||||
| CVE-2026-96924 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 9.8 Critical |
| Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96926 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-17 | 5.5 Medium |
| Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-102185 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-17 | 7.5 High |
| A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election. | ||||
| CVE-2026-110112 | 1 Finsys | 1 Dockhand | 2026-10-17 | 8.1 High |
| Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators. | ||||
| CVE-2026-102046 | 1 Juniper Networks | 1 Junos Os | 2026-10-17 | 7.5 High |
| A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic. | ||||
| CVE-2026-96921 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-70186 | 1 Microsoft | 3 Asp.net Core, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-16 | 7.5 High |
| Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-110123 | 1 Maku | 1 Maku-boot | 2026-10-16 | 7.1 High |
| Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks. Attackers can retrieve unmasked SMTP passwords and Aliyun, Tencent Cloud, Qiniu or Huawei Cloud access keys, and abuse /sys/mail/config/send to send mail to arbitrary recipients. | ||||
| CVE-2026-98397 | 1 Linux | 1 Linux Kernel | 2026-10-16 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim. Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset(). | ||||
| CVE-2026-77361 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-16 | 4.7 Medium |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path. | ||||