Export limit exceeded: 419882 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419882 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419882 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419882 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419882 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118377 | 1 Mewebstudio | 1 Pos | 2026-11-04 | 7.5 High |
| mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying. | ||||
| CVE-2026-117929 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 8.8 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117928 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.1 High |
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117921 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117920 | 1 Mozilla | 1 Firefox | 2026-11-04 | 9.6 Critical |
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117918 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117466 | 1 Octopus | 1 Octopus Server | 2026-11-04 | N/A |
| In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. | ||||
| CVE-2026-117341 | 1 Octopus | 1 Octopus Server | 2026-11-04 | N/A |
| In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user. | ||||
| CVE-2026-116662 | 1 Tanium | 1 Enforce | 2026-11-04 | 7.5 High |
| Tanium addressed a compression bomb vulnerability in Enforce. | ||||
| CVE-2026-116659 | 1 Tanium | 1 Enforce | 2026-11-04 | 4.3 Medium |
| Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | ||||
| CVE-2026-116657 | 1 Tanium | 1 Enforce | 2026-11-04 | 5.3 Medium |
| Tanium addressed a denial of service vulnerability in Enforce. | ||||
| CVE-2026-116656 | 1 Tanium | 1 Enforce | 2026-11-04 | 7.5 High |
| Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | ||||
| CVE-2026-116214 | 2 Maccms, Magicblack | 2 Maccms, Maccms10 | 2026-11-04 | 9.1 Critical |
| MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account. | ||||
| CVE-2026-115750 | 1 Frontmcp | 1 Mcp-from-openapi | 2026-11-04 | 3.7 Low |
| mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies. | ||||
| CVE-2026-115498 | 2026-11-04 | 7.2 High | ||
| The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode. | ||||
| CVE-2026-115495 | 1 Watchguard | 1 Mobile Vpn With Ssl Client | 2026-11-04 | N/A |
| Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password. | ||||
| CVE-2026-115413 | 1 Aws | 1 Aws-api-mcp-server | 2026-11-04 | 7.8 High |
| Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server. | ||||
| CVE-2026-115353 | 2 Lepture, Mistune Project | 2 Mistune, Mistune | 2026-11-04 | 8.6 High |
| Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML. | ||||
| CVE-2026-115334 | 1 Uselotus | 1 Lotus | 2026-11-04 | 6.8 Medium |
| Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration. | ||||
| CVE-2026-115330 | 1 Uselotus | 1 Lotus | 2026-11-04 | 8.8 High |
| Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants. | ||||