Export limit exceeded: 10235 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 418957 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418957 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12765 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-11-03 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-12763 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-11-03 | 4.2 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component. | ||||
| CVE-2026-17628 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-11-03 | 5.4 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication. | ||||
| CVE-2026-63197 | 2026-11-03 | 7.3 High | ||
| traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3. | ||||
| CVE-2026-93683 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 6.4 Medium |
| A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix. | ||||
| CVE-2026-86856 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 6.5 Medium |
| A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. | ||||
| CVE-2026-86849 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. | ||||
| CVE-2026-86847 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. | ||||
| CVE-2026-86846 | 2 Dpdk, Redhat | 4 Dpdk, Enterprise Linux, Openshift and 1 more | 2026-11-03 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. | ||||
| CVE-2026-86845 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend. | ||||
| CVE-2026-86566 | 3 Dpdk, Red Hat, Redhat | 6 Dpdk, Enterprise Linux, Enterprise Linux and 3 more | 2026-11-03 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. | ||||
| CVE-2026-86561 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more | 2026-11-03 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption. | ||||
| CVE-2026-97350 | 2026-11-03 | N/A | ||
| Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: * Improper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\SYSTEM privileges. * Argument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration. | ||||
| CVE-2026-97072 | 2026-11-03 | 4.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-86848 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 8.8 High |
| A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend. | ||||
| CVE-2026-86567 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more | 2026-11-03 | 8.8 High |
| A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. | ||||
| CVE-2026-86565 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more | 2026-11-03 | 8.2 High |
| A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. | ||||
| CVE-2026-86563 | 3 Dpdk, Red Hat, Redhat | 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more | 2026-11-03 | 7.8 High |
| A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. | ||||
| CVE-2026-86562 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-03 | 7.8 High |
| A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler. | ||||
| CVE-2026-65631 | 1 Potatosalad | 1 Jose | 2026-11-03 | N/A |
| Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API (or the Elixir wrappers JOSE.JWK.from_binary/1 and JOSE.JWK.from_map/1), an RSA private key that supplies d, e, and n but omits all Chinese Remainder Theorem parameters (p, q, dp, dq, qi) is routed into convert_sfm_to_crt/1, which tries to recover the missing primes by factoring the modulus. The three integers are read straight from the base64url input and are never validated as a real RSA key. When the modulus cannot be split into two factors (for example, when it is itself prime), the search loop convert_sfm_to_crt_find_p/6 performs a modular exponentiation over the attacker-sized modulus on every iteration and never succeeds. A single request of a few hundred bytes forces close to one CPU-second of work before an internal one-second watchdog kills the worker, and a larger modulus raises the cost further. By flooding such requests an attacker can saturate every scheduler and deny service, without credentials, a valid RSA key, or any special configuration. This issue affects jose: from 1.7.7 before 1.11.13. | ||||