Export limit exceeded: 414517 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414517 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414517 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414517 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112880 | 1 Benoitc | 1 Hackney | 2026-10-26 | N/A |
| Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0. | ||||
| CVE-2026-111231 | 2 Netgate, Pfsense | 2 Pfsense, Pfsense | 2026-10-26 | 7.2 High |
| Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot. | ||||
| CVE-2026-111226 | 1 Netgate | 2 Pfsense, Pfsense Ce | 2026-10-26 | 7.2 High |
| pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart. | ||||
| CVE-2026-111221 | 2 Netgate, Pfsense | 2 Pfsense, Pfsense | 2026-10-26 | 6.6 Medium |
| Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts. | ||||
| CVE-2026-111216 | 2 Netgate, Pfsense | 3 Pfsense, Pfsense Ce, Pfsense | 2026-10-26 | 7.2 High |
| Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied. | ||||
| CVE-2026-111124 | 1 Nasa | 1 Cfitsio | 2026-10-26 | 6.1 Medium |
| CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels. | ||||
| CVE-2026-111103 | 1 Mtrudel | 1 Bandit | 2026-10-26 | N/A |
| Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once. This issue affects bandit: from 1.9.0 before 1.14.0. | ||||
| CVE-2026-111101 | 1 Mtrudel | 1 Bandit | 2026-10-26 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader. This issue affects bandit: from 0.1.0 before 1.14.0. | ||||
| CVE-2026-110875 | 1 Adplug Project | 1 Adplug | 2026-10-26 | 6.1 Medium |
| AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service. | ||||
| CVE-2026-110870 | 1 Nodemailer | 1 Nodemailer | 2026-10-26 | 5.3 Medium |
| Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists. | ||||
| CVE-2026-110865 | 2 Mend, Renovatebot | 6 Mend-renovate-ce Helm Chart, Mend-renovate-enterprise-edition Helm Chart, Renovate-ce and 3 more | 2026-10-26 | 7.1 High |
| Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts. | ||||
| CVE-2026-110860 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-10-26 | 6.1 Medium |
| GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules. | ||||
| CVE-2026-110499 | 1 Mtrudel | 1 Bandit | 2026-10-26 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly. The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process. This issue affects bandit: from 0.3.6 before 1.14.0. | ||||
| CVE-2026-109584 | 1 Mtrudel | 1 Bandit | 2026-10-26 | N/A |
| Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0. | ||||
| CVE-2026-108529 | 1 Mtrudel | 1 Bandit | 2026-10-26 | N/A |
| Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process. do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n. This issue affects bandit: from 0.3.4 before 1.14.0. | ||||
| CVE-2026-108525 | 1 Mtrudel | 1 Bandit | 2026-10-26 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0. | ||||
| CVE-2026-107157 | 1 Qt | 2 Qt, Qtbase | 2026-10-26 | N/A |
| Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework. | ||||
| CVE-2025-69035 | 1 Wordpress | 1 Wordpress | 2026-10-26 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6. | ||||
| CVE-2026-74860 | 1 Redhat | 11 Cert Manager, Cost Management On Premise, Enterprise Linux and 8 more | 2026-10-26 | 8.5 High |
| A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. | ||||
| CVE-2026-78850 | 1 Matomo | 1 Matomo | 2026-10-26 | 5 Medium |
| An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary. | ||||