Export limit exceeded: 94246 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94246 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110075 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-29 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-53987 | 1 Pluginsglpi | 1 Glpi 11 | 2026-10-29 | 6.4 Medium |
| The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to. | ||||
| CVE-2026-109266 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | 5.3 Medium |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML. | ||||
| CVE-2026-104436 | 2 Zcashfoundation, Zfnd | 3 Zebra, Zebra, Zebra-chain | 2026-10-29 | 3.7 Low |
| Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance. | ||||
| CVE-2025-71334 | 1 Flowiseai | 1 Flowise | 2026-10-29 | 9.8 Critical |
| Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution. | ||||
| CVE-2025-34253 | 2 D-link, Dlink | 2 Nuclias Connect, Nuclias Connect | 2026-10-29 | 5.4 Medium |
| D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link fixed this issue in version 1.3.1.5. | ||||
| CVE-2025-30006 | 1 Xorcom | 1 Completepbx | 2026-10-29 | 6.1 Medium |
| Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all versions up to and including 5.2.35 | ||||
| CVE-2024-58394 | 1 Retool | 1 Retool | 2026-10-29 | 6.1 Medium |
| Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15. | ||||
| CVE-2024-58296 | 2 Oscommerce, Phoenixcart | 2 Ce Phoenix, Ce Phoenix Cart | 2026-10-29 | N/A |
| CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page. | ||||
| CVE-2024-23690 | 1 Netgear | 2 Fvs336gv2, Fvs336gv3 | 2026-10-29 | 7.2 High |
| The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted "util backup_configuration" commands. | ||||
| CVE-2026-61995 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | ||||
| CVE-2026-61988 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. | ||||
| CVE-2026-42692 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | ||||
| CVE-2026-118097 | 2026-10-29 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0. | ||||
| CVE-2026-116181 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-10-29 | 6.5 Medium |
| vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids. Attackers can send OpenAI chat, completion, generate, or batch requests with invalid IDs to terminate the engine or write outside the V2 runner's logits buffer. | ||||
| CVE-2026-116169 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-10-29 | 5.4 Medium |
| SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that mathRender assigns via innerHTML, executing script in the application origin when a reader clicks the rendered link. | ||||
| CVE-2026-116153 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | 2.5 Low |
| ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution. | ||||
| CVE-2026-116149 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | 8.1 High |
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption. | ||||
| CVE-2026-116141 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | 5.3 Medium |
| ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption. | ||||
| CVE-2026-116050 | 1 Krupalshah | 1 Employee Recruitment System | 2026-10-29 | 7.3 High |
| A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||