Export limit exceeded: 413914 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413914 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4250 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109569 | 1 Th0rgal | 1 Sandboxed.sh | 2026-10-13 | 8.8 High |
| sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation. | ||||
| CVE-2026-109391 | 1 Square | 1 Squash | 2026-10-13 | 8.1 High |
| Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution. | ||||
| CVE-2026-109373 | 1 Zitadel | 1 Zitadel | 2026-10-13 | 8.1 High |
| ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions. | ||||
| CVE-2026-109372 | 1 Zitadel | 1 Zitadel | 2026-10-13 | 8.7 High |
| ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations. | ||||
| CVE-2026-108917 | 1 Edimax | 2 Br-6208ac, Br-6208ac Firmware | 2026-10-13 | 10 Critical |
| A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108915 | 1 Edimax | 2 Br-6208ac, Br-6208ac Firmware | 2026-10-13 | 9.9 Critical |
| A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108907 | 1 Netcore | 1 Nr268 | 2026-10-13 | 10 Critical |
| A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-107780 | 1 Dromara | 1 Skyeye | 2026-10-13 | 9.8 Critical |
| Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows. | ||||
| CVE-2025-71429 | 1 Rvc-boss | 1 Gpt-sovits-webui | 2026-10-13 | 9.8 Critical |
| GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user. | ||||
| CVE-2026-77099 | 2026-10-13 | N/A | ||
| CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS. | ||||
| CVE-2026-109238 | 1 Unclecode | 1 Crawl4ai | 2026-10-13 | 8.6 High |
| Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data. | ||||
| CVE-2026-108895 | 1 Linksys | 2 E1700, E1700 Firmware | 2026-10-13 | 9.9 Critical |
| A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108362 | 1 Privasys | 1 Ra-tls-clients | 2026-10-13 | N/A |
| Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0. | ||||
| CVE-2026-108267 | 1 Privasys | 1 Go | 2026-10-13 | N/A |
| Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5. | ||||
| CVE-2026-74040 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-13 | 9.1 Critical |
| Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent. | ||||
| CVE-2026-92414 | 1 Apache | 1 Jackrabbit | 2026-10-13 | 9.1 Critical |
| : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue. | ||||
| CVE-2026-73642 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4. | ||||
| CVE-2026-73640 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. This issue was fixed in version V3. | ||||
| CVE-2026-109573 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-13 | 8.1 High |
| phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables. | ||||
| CVE-2026-63350 | 2026-10-13 | 9.6 Critical | ||
| Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization. | ||||