Export limit exceeded: 26069 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 26069 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416426 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416426 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-10277 | 2 Iocoder, Yunaiv | 2 Yudao-cloud, Yudao-cloud | 2026-10-27 | 6.3 Medium |
| A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as 0f573e1d8e1a895e1bcbb7740ef75306412c3f9d (master-jdk17). It is best practice to apply a patch to resolve this issue. The vendor confirms: "[W]e have now added the missing per-record CRM WRITE permission check to submitReceivable, the path reported as CVE-2025-10277, in both Boot and Cloud master-jdk17. Possession of a functional submit permission alone no longer permits submission of a record for which the caller lacks CRM write access." | ||||
| CVE-2026-111461 | 1 Moxa | 1 Oncell G3150a-lte Series | 2026-10-27 | N/A |
| An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required privileges could exploit insufficient input validation in the SMS management functionality to execute arbitrary commands on the affected device. | ||||
| CVE-2026-101034 | 2026-10-27 | N/A | ||
| An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation. | ||||
| CVE-2026-116816 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-27 | 7.8 High |
| llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution. | ||||
| CVE-2026-111460 | 1 Moxa | 1 Oncell G3150a-lte Series | 2026-10-27 | N/A |
| A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerated their cryptographic keys, potentially compromising the confidentiality and integrity of management communications. | ||||
| CVE-2026-112637 | 1 Apple | 6 Ios And Ipados, Macos, Safari and 3 more | 2026-10-27 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-105946 | 1 Qt | 2 Qt, Qtbase | 2026-10-27 | N/A |
| Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM. | ||||
| CVE-2026-116590 | 1 Xerial | 1 Snappy-java | 2026-10-27 | 5.9 Medium |
| snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9. | ||||
| CVE-2024-58399 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-27 | 6.1 Medium |
| llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the process or load adjacent process memory as model weights. | ||||
| CVE-2025-71439 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-27 | 5.5 Medium |
| llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash. | ||||
| CVE-2026-116638 | 2026-10-27 | N/A | ||
| The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources. | ||||
| CVE-2026-112428 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks. | ||||
| CVE-2026-112628 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-27 | N/A |
| This issue was addressed with improved data access restriction. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-116588 | 1 Datadog | 1 Dd-trace-py | 2026-10-27 | N/A |
| Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6. | ||||
| CVE-2026-116589 | 1 Datadog | 1 Dd-trace-py | 2026-10-27 | N/A |
| Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5. | ||||
| CVE-2026-116508 | 1 Totolink | 2 A950rg, A950rg Firmware | 2026-10-27 | 10 Critical |
| A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-112541 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | ||||
| CVE-2026-86937 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks. | ||||
| CVE-2026-115597 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-10-27 | 5.4 Medium |
| Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11. | ||||
| CVE-2026-112530 | 1 Apple | 1 Macos | 2026-10-27 | N/A |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | ||||