Export limit exceeded: 424743 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424743 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17301 | 1 Ibm | 1 Api Connect | 2026-11-10 | 9.8 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature. | ||||
| CVE-2026-66333 | 2026-11-10 | N/A | ||
| AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also impact Confidentiality, and Availability. | ||||
| CVE-2026-66332 | 2026-11-10 | N/A | ||
| AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also potentially impact Confidentiality and Availability. | ||||
| CVE-2026-61547 | 2026-11-10 | N/A | ||
| rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0. | ||||
| CVE-2026-17306 | 1 Ibm | 1 Api Connect | 2026-11-10 | 5.8 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery. | ||||
| CVE-2026-16325 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 4.4 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header. | ||||
| CVE-2026-16427 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 6.5 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability. | ||||
| CVE-2026-16433 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 6.5 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability. | ||||
| CVE-2026-18093 | 1 Ibm | 1 App Connect Enterprise | 2026-11-10 | 7.5 High |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control. | ||||
| CVE-2026-18196 | 1 Ibm | 1 App Connect Enterprise | 2026-11-10 | 5.4 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization. | ||||
| CVE-2026-97677 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-11-10 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory. | ||||
| CVE-2026-68993 | 1 Samsung Semiconductor | 2 Exynos 1480, Exynos 2400 | 2026-11-10 | 6.3 Medium |
| A double free vulnerability in NPU driver due to improper pointer management (940) | ||||
| CVE-2026-48186 | 1 Samsung Semiconductor | 13 Exynos 1280, Exynos 1330, Exynos 1380 and 10 more | 2026-11-10 | 9.1 Critical |
| Improper handling of messages before AS security activation can cause unexpected behavior | ||||
| CVE-2026-17402 | 1 Ibm | 1 Api Connect | 2026-11-10 | 9.9 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host. | ||||
| CVE-2026-17172 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party. | ||||
| CVE-2026-125652 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-10 | 6.8 Medium |
| A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier. | ||||
| CVE-2026-122014 | 1 Npc-worldwide | 1 Npcpy | 2026-11-10 | 6.3 Medium |
| A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-84229 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 6.5 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests. | ||||
| CVE-2026-109830 | 2026-11-10 | 7.3 High | ||
| A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device. | ||||
| CVE-2026-84228 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 3.1 Low |
| IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | ||||