Export limit exceeded: 416389 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416389 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103406 | 1 Juniper | 1 Session Smart Conductor | 2026-10-28 | 9.8 Critical |
| An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID. | ||||
| CVE-2026-103407 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. | ||||
| CVE-2026-103408 | 1 Juniper | 1 Session Smart Router | 2026-10-28 | 8.8 High |
| A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply. | ||||
| CVE-2026-103409 | 1 Juniper | 1 Session Smart Router | 2026-10-28 | 9.8 Critical |
| A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor. | ||||
| CVE-2026-103411 | 1 Juniper | 1 Session Smart Router | 2026-10-28 | 7.1 High |
| An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply. | ||||
| CVE-2026-106079 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration. | ||||
| CVE-2026-117622 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-10-28 | N/A |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes. | ||||
| CVE-2026-114596 | 1 The Epics Community | 1 Epics Base | 2026-10-28 | 8.2 High |
| In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service. | ||||
| CVE-2026-114597 | 1 The Epics Community | 1 Epics Base | 2026-10-28 | 7.5 High |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. | ||||
| CVE-2026-108015 | 1 Hcltech | 1 Notes | 2026-10-28 | N/A |
| Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections. | ||||
| CVE-2026-114598 | 1 The Epics Community | 1 Epics Base | 2026-10-28 | 7.5 High |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. | ||||
| CVE-2026-116677 | 1 Openwisp | 1 Openwisp-controller | 2026-10-28 | N/A |
| OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2. | ||||
| CVE-2026-87085 | 1 Tanium | 1 Provision | 2026-10-28 | 6.5 Medium |
| Tanium addressed a SQL injection vulnerability in Provision. | ||||
| CVE-2026-108307 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Index-cx | 2026-10-28 | 7.8 High |
| Tanium addressed a heap-based buffer overflow vulnerability in Index. | ||||
| CVE-2026-108326 | 1 Tanium | 2 Cx-stream, Endpoint Configuration Toolset Solution | 2026-10-28 | 6.5 Medium |
| Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. | ||||
| CVE-2026-87086 | 1 Tanium | 1 Provision | 2026-10-28 | 7.5 High |
| Tanium addressed a denial of service vulnerability in Provision. | ||||
| CVE-2026-108303 | 1 Tanium | 1 Certificate Manager | 2026-10-28 | 8.8 High |
| Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. | ||||
| CVE-2026-118170 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-10-28 | N/A |
| The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document. | ||||
| CVE-2026-118172 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-10-28 | N/A |
| The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller. | ||||
| CVE-2026-118171 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-10-28 | N/A |
| The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions. | ||||