Export limit exceeded: 418049 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418049 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-94349 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 8 High |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution. | ||||
| CVE-2026-91908 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 5.7 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution. | ||||
| CVE-2026-115998 | 1 Cervantessec | 1 Cervantes | 2026-11-02 | 4.3 Medium |
| IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity. | ||||
| CVE-2026-115994 | 1 Cervantessec | 1 Cervantes | 2026-11-02 | 5.4 Medium |
| BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports. | ||||
| CVE-2026-115993 | 1 Cervantessec | 1 Cervantes | 2026-11-02 | 6.8 Medium |
| Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges | ||||
| CVE-2026-91910 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 5.7 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure. | ||||
| CVE-2026-91909 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 4.6 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution. | ||||
| CVE-2026-91907 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 6.8 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering | ||||
| CVE-2026-91905 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 6.4 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker. | ||||
| CVE-2026-115456 | 3 Gcc, Red Hat, Redhat | 7 Gcc, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-02 | 3.7 Low |
| A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash. | ||||
| CVE-2026-120310 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-02 | 3.1 Low |
| Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field. | ||||
| CVE-2026-91904 | 1 Dell | 1 Openmanage Enterprise | 2026-11-02 | 5.5 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | ||||
| CVE-2026-74993 | 2026-11-02 | 7.5 High | ||
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16. | ||||
| CVE-2026-74860 | 1 Redhat | 16 Cert Manager, Cost Management On Premise, Enterprise Linux and 13 more | 2026-11-02 | 8.5 High |
| A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. | ||||
| CVE-2026-111959 | 2026-11-02 | N/A | ||
| Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue. | ||||
| CVE-2024-12141 | 1 Wso2 | 2 Identity Server, Wso2 Identity Server | 2026-11-02 | 4.3 Medium |
| The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft. | ||||
| CVE-2026-97229 | 2 Gitlab, Ruby-lang | 2 Gitlab, Ruby | 2026-11-02 | 10 Critical |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | ||||
| CVE-2026-102802 | 2026-11-02 | N/A | ||
| Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue. | ||||
| CVE-2026-103419 | 2026-11-02 | N/A | ||
| Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11. | ||||
| CVE-2026-103420 | 2026-11-02 | N/A | ||
| Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5 | ||||