Export limit exceeded: 17819 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17819 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95168 | 1 Nvbn | 1 Thefuck | 2026-10-21 | 7.8 High |
| An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py | ||||
| CVE-2026-114493 | 1 Mudler | 1 Localai | 2026-10-21 | 8.6 High |
| LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content. | ||||
| CVE-2026-114401 | 1 Trudesk Project | 1 Trudesk | 2026-10-21 | 5.3 Medium |
| Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts. | ||||
| CVE-2026-111687 | 1 Rachelos | 1 Werss | 2026-10-21 | 9.8 Critical |
| WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account. | ||||
| CVE-2026-114396 | 1 Trudesk Project | 1 Trudesk | 2026-10-21 | 7.1 High |
| Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes. | ||||
| CVE-2026-78497 | 1 Perl | 1 Jq::lite | 2026-10-21 | 8.4 High |
| JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process. | ||||
| CVE-2026-91831 | 1 Wordpress-extensions | 1 Subscribe To Comments | 2026-10-21 | 3.8 Low |
| The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender. | ||||
| CVE-2026-110887 | 2 Hivepress, Wordpress-extensions | 2 Hivepress, Hivepress | 2026-10-21 | 9.9 Critical |
| Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32. | ||||
| CVE-2026-111936 | 1 Aleksey-hoffman | 1 Sigma File Manager | 2026-10-21 | 4.3 Medium |
| Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory. | ||||
| CVE-2026-112308 | 2 Crewai, Crewaiinc | 2 Crewai, Crewai-tools | 2026-10-21 | 7.4 High |
| crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials. | ||||
| CVE-2026-100737 | 1 Atsumi Electric | 10 Adx1004, Adx1008, Adx2016 and 7 more | 2026-10-21 | N/A |
| Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware. | ||||
| CVE-2026-97627 | 1 Atsumi Electric | 10 Adx1004, Adx1008, Adx2016 and 7 more | 2026-10-21 | N/A |
| Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands. | ||||
| CVE-2026-113402 | 1 Armorx Global Technology | 1 Armorx Spam | 2026-10-21 | 6.5 Medium |
| ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory. | ||||
| CVE-2026-112239 | 1 Typo3 | 1 Extension Typo3 Ai Integration Extension | 2026-10-21 | N/A |
| The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them. | ||||
| CVE-2026-112237 | 1 Typo3 | 1 Extension Kitodo.presentation | 2026-10-21 | N/A |
| The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed. | ||||
| CVE-2026-113704 | 1 A2aproject | 1 A2a-rs | 2026-10-21 | 7.3 High |
| A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue. | ||||
| CVE-2026-106577 | 1 Imagemagick | 1 Imagemagick | 2026-10-21 | 5.3 Medium |
| ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56. | ||||
| CVE-2026-105301 | 1 Redhat | 2 Build Of Keycloak, Single Sign-on | 2026-10-21 | 4.0 Medium |
| This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests. | ||||
| CVE-2026-98781 | 1 Linux | 1 Linux Kernel | 2026-10-21 | 2.3 Low |
| In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtk_drm_bind() When the device is not the mmsys master, mtk_drm_bind() returns early after taking a reference on the disp-mutex device via of_find_device_by_node(), without ever dropping it: mtk_drm_unbind() only puts mutex_dev for the master. Drop the reference before returning from the non-master path. | ||||
| CVE-2026-98743 | 1 Linux | 1 Linux Kernel | 2026-10-21 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM. While at it, use snd_sdw_params_to_config() helper instead of open-coding the same logic. | ||||