Export limit exceeded: 424542 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424542 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424542 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95521 | 2 Redhat, Rpm | 6 Enterprise Linux, Hardened Images, Hummingbird and 3 more | 2026-11-06 | 7.8 High |
| A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. | ||||
| CVE-2026-95519 | 2 Redhat, Rpm | 6 Enterprise Linux, Hardened Images, Hummingbird and 3 more | 2026-11-06 | 7.8 High |
| A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. | ||||
| CVE-2026-40802 | 2026-11-06 | 7.6 High | ||
| Missing Authorization vulnerability in pubjet Pubjet | پابجت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پابجت: from n/a through 5.4.8. | ||||
| CVE-2024-7259 | 2 Ovirt, Redhat | 3 Ovirt-engine, Rhev Manager, Virtualization | 2026-11-06 | 4.9 Medium |
| A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext. | ||||
| CVE-2026-93432 | 1 Redhat | 12 Apache Camel Quarkus, Apicurio Registry, Build Keycloak and 9 more | 2026-11-06 | 6.1 Medium |
| A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data. | ||||
| CVE-2026-15562 | 1 Redhat | 5 Jboss-remoting, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els and 2 more | 2026-11-06 | 7.5 High |
| A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service. | ||||
| CVE-2026-120194 | 3 Json-glib, Red Hat, Redhat | 7 Json-glib, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-06 | 7.5 High |
| A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service. | ||||
| CVE-2026-121621 | 1 Redhat | 1 Openshift Gitops | 2026-11-06 | 8.8 High |
| A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process. | ||||
| CVE-2026-121997 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-06 | 8.1 High |
| A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer. | ||||
| CVE-2026-107129 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-11-06 | 5.5 Medium |
| Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0 | ||||
| CVE-2026-107130 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-11-06 | N/A |
| Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0 | ||||
| CVE-2026-107903 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-11-06 | 8.3 High |
| Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0 | ||||
| CVE-2026-105607 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-11-06 | 8.3 High |
| Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0 | ||||
| CVE-2026-119377 | 1 Sqlite | 1 Sqlite | 2026-11-06 | 2.5 Low |
| SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions. | ||||
| CVE-2026-97029 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 5.7 Medium |
| Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell. | ||||
| CVE-2026-117618 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-06 | 8.1 High |
| In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced. | ||||
| CVE-2026-119572 | 1 Traefik | 1 Traefik | 2026-11-06 | 8.7 High |
| Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates. | ||||
| CVE-2026-83525 | 1 Apache | 1 Kafka | 2026-11-06 | 6.5 Medium |
| Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshotRequest with an empty topics array or a topic with no partitions. Users are recommended to upgrade to version 4.2.2, 4.3.2, or 4.4.0, which fix this issue. Users on unsupported branches (4.1.x and earlier) should upgrade to 4.2.2 or later. | ||||
| CVE-2026-116593 | 1 Apache | 1 Kafka | 2026-11-06 | 8.1 High |
| Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue. | ||||
| CVE-2026-114349 | 1 Apache | 1 Kafka | 2026-11-06 | 6.5 Medium |
| When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decompressed size. Impact: An authenticated principal with Write on a topic can crash broker request-handler threads (reached when a batch's codec differs from the topic's compression.type and records are re-encoded) and any consumer that fetches the record, denying service. On brokers started with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the broker JVM. More seriously, a crafted record is accepted at ingest and written to disk; when the log-cleaner later reads it on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner thread, which is not restarted. With the default of a single cleaner thread, log compaction then stops for the entire broker, including the internal __consumer_offsets and __transaction_state topics, and the condition persists across restarts until the offending record is removed. The impact is availability only; no data is disclosed or altered. Mitigation: Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is not sufficient: for backward compatibility this configuration defaults to an effectively unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a value at or slightly above the largest legitimate decompressed record your applications produce, and comfortably below the broker heap divided by the number of request-handler and cleaner threads. Until you can upgrade and configure the limit, restrict Write access to trusted producers; quotas and max.message.bytes do not mitigate this issue. Resolution: From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record's declared decompressed body size against max.decompressed.message.bytes before allocating, on the produce-validation, log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with InvalidRecordException. Operators must set this configuration to a bounded value to be protected, as its default is effectively unlimited. | ||||