Export limit exceeded: 421041 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421041 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421041 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-30897 | 1 Fortinet | 1 Fortiweb | 2026-11-06 | 5.9 Medium |
| A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. | ||||
| CVE-2026-25689 | 1 Fortinet | 1 Fortideceptor | 2026-11-06 | 6 Medium |
| An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions may allow a privileged attacker with super-admin profile and CLI access to delete sensitive files via crafted HTTP requests. | ||||
| CVE-2026-24641 | 1 Fortinet | 1 Fortiweb | 2026-11-06 | 2.5 Low |
| A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests. | ||||
| CVE-2026-24640 | 1 Fortinet | 1 Fortiweb | 2026-11-06 | 5.9 Medium |
| A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0.2 through 7.0.12 may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. | ||||
| CVE-2026-23708 | 1 Fortinet | 4 Fortisoar, Fortisoar On-premise, Fortisoaron-premise and 1 more | 2026-11-06 | 6.7 Medium |
| A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity. | ||||
| CVE-2026-22576 | 1 Fortinet | 4 Fortisoar, Fortisoar On-premise, Fortisoaron-premise and 1 more | 2026-11-06 | 4.1 Medium |
| A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration. | ||||
| CVE-2026-22154 | 1 Fortinet | 4 Fortisoar, Fortisoar On-premise, Fortisoaron-premise and 1 more | 2026-11-06 | 4.4 Medium |
| An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests. | ||||
| CVE-2026-106170 | 1 Fortinet | 1 Fortisandbox | 2026-11-06 | 4.8 Medium |
| An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. | ||||
| CVE-2026-66987 | 2026-11-06 | 5.3 Medium | ||
| HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-66982 | 2026-11-06 | 3.3 Low | ||
| HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-66984 | 2026-11-06 | 3.1 Low | ||
| HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-123676 | 2 201206030, Xxyopen | 2 Novel, Novel | 2026-11-06 | 5.3 Medium |
| A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue. | ||||
| CVE-2026-118548 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 3.7 Low |
| Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118546 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118545 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118560 | 1 Drupal | 1 Commerce Stripe | 2026-11-06 | 5.1 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3. | ||||
| CVE-2026-118543 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 5.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-114573 | 1 Drupal | 1 Monster Menus | 2026-11-06 | 8.8 High |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6. | ||||
| CVE-2026-114554 | 1 Drupal | 1 Ai File To Text | 2026-11-06 | 4.3 Medium |
| Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1. | ||||
| CVE-2026-107256 | 1 Drupal | 1 Shield | 2026-11-06 | 5.3 Medium |
| Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0. | ||||