Export limit exceeded: 424633 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424633 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105583 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-11-11 | 7 High |
| Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-110697 | 1 Redhat | 2 Openshift Update Service, Quay | 2026-11-11 | 9.9 Critical |
| A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations. | ||||
| CVE-2026-108167 | 2026-11-11 | N/A | ||
| The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. | ||||
| CVE-2025-29941 | 2026-11-11 | N/A | ||
| Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor or migration agent to import a forged guest context potentially resulting in loss of confidentiality for derived guest keys. | ||||
| CVE-2025-0008 | 2026-11-11 | N/A | ||
| Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access. | ||||
| CVE-2024-36309 | 2026-11-11 | N/A | ||
| Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability. | ||||
| CVE-2026-105948 | 1 Octopus | 1 Octopus Server | 2026-11-11 | N/A |
| In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled. | ||||
| CVE-2026-107496 | 1 Openssl | 1 Openssl | 2026-11-11 | N/A |
| Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service. CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns. The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop. OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option. The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected. The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely. FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached. | ||||
| CVE-2026-124694 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established. | ||||
| CVE-2026-119723 | 2026-11-11 | N/A | ||
| When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5. | ||||
| CVE-2026-121737 | 2026-11-11 | N/A | ||
| When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could free that pipelined stream while resetting the connection's streams on the resulting write timeout, then go on to use it. This can crash the server, leading to denial of service, and may allow memory corruption with further impact. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-119237 | 2026-11-11 | N/A | ||
| In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-119236 | 2026-11-11 | N/A | ||
| An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00. | ||||
| CVE-2026-119235 | 2026-11-11 | N/A | ||
| proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and then keep sending data, causing the decoder to buffer it without bound for the lifetime of the connection and exhaust memory, leading to denial of service. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-119234 | 2026-11-11 | N/A | ||
| mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0. | ||||
| CVE-2026-119233 | 2026-11-11 | N/A | ||
| proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A remote, unauthenticated HTTP/3 peer could declare a very large frame and deliver it slowly, causing unbounded memory growth and CPU usage that grows quadratically with the number of fragments, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-124693 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established. | ||||
| CVE-2026-124692 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established. | ||||
| CVE-2026-124690 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110. | ||||
| CVE-2026-124689 | 2026-11-11 | 7.1 High | ||
| In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established. | ||||