Export limit exceeded: 416358 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416358 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416358 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416358 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116844 | 1 Fclairamb | 1 Ftpserverlib | 2026-10-28 | 4.8 Medium |
| Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them. | ||||
| CVE-2026-116837 | 1 Ubiquiti | 4 Airmax M, Ltu Ptmp, Ltu Ptp and 1 more | 2026-10-28 | 8.8 High |
| A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device. | ||||
| CVE-2026-117468 | 1 Esaqa | 1 Psono | 2026-10-28 | 6.5 Medium |
| Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets. | ||||
| CVE-2026-117469 | 1 Esaqa | 1 Psono | 2026-10-28 | 5.4 Medium |
| Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits. | ||||
| CVE-2026-117470 | 1 Esaqa | 1 Psono | 2026-10-28 | 6.5 Medium |
| Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the WebAuthn second factor. The attack required capture of a valid assertion and did not itself disclose plaintext secrets. | ||||
| CVE-2026-117471 | 1 Esaqa | 1 Psono | 2026-10-28 | 5.4 Medium |
| Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout. | ||||
| CVE-2026-117472 | 1 Esaqa | 1 Psono | 2026-10-28 | 4.3 Medium |
| Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected. | ||||
| CVE-2026-111459 | 1 Moxa | 2 Moxa Remote Connect Suite (mrc Client), Moxa Remote Connect Suite Mrc Client | 2026-10-28 | N/A |
| An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications. | ||||
| CVE-2026-16521 | 1 Smci | 1 Mbd-x12stw-f | 2026-10-28 | 7.2 High |
| An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted. | ||||
| CVE-2026-18449 | 1 Smci | 1 X12spi | 2026-10-28 | 7.5 High |
| The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | ||||
| CVE-2026-18450 | 1 Smci | 1 X12spi | 2026-10-28 | 9.8 Critical |
| The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | ||||
| CVE-2026-18451 | 1 Smci | 1 Mbd-x12spi | 2026-10-28 | 3.1 Low |
| The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session. | ||||
| CVE-2026-65219 | 1 Smci | 1 Mbd-x12spi | 2026-10-28 | 7.4 High |
| A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands. | ||||
| CVE-2026-65220 | 1 Smci | 1 Mbd-x12spi | 2026-10-28 | 8.8 High |
| A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges. | ||||
| CVE-2026-65210 | 1 Smci | 1 Mbd-x12spi | 2026-10-28 | 4.9 Medium |
| This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role. | ||||
| CVE-2026-65211 | 1 Smci | 1 Mbd-x12spi | 2026-10-28 | 7.2 High |
| This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system. | ||||
| CVE-2026-65213 | 1 Smci | 1 Mbd-x12spi | 2026-10-28 | 6.6 Medium |
| This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC | ||||
| CVE-2026-85299 | 1 Google Cloud | 1 Compute Engine | 2026-10-28 | N/A |
| A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August 2026, and no customer action is needed. | ||||
| CVE-2026-117493 | 2 Cloud Bi Platform, Sisense | 2 Sisense, Cloud Bi Platform | 2026-10-28 | N/A |
| Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context. | ||||
| CVE-2026-86574 | 1 Hitachi | 1 Jp1/base | 2026-10-28 | 9.8 Critical |
| Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Base: from 11-00 before 12-50-54. | ||||