Search
4,652 CVEs
CVEs (4,652, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 4,652 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-56387 | NONE | — | 2026-10-21 | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server … | |
| CVE-2026-56388 | NONE | — | 2026-10-21 | The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis ser… | |
| CVE-2026-58064 | NONE | — | 2026-10-21 | The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command wa… | |
| CVE-2026-59229 | NONE | Patched | — | 2026-10-21 | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with on… |
| CVE-2026-54425 | NONE | Patched | — | 2026-10-21 | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block … |
| CVE-2026-48830 | NONE | Patched | — | 2026-10-21 | Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first se… |
| CVE-2026-41114 | NONE | Patched | — | 2026-10-21 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommen… |
| CVE-2026-58663 | NONE | Patched | — | 2026-10-21 | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to… |
| CVE-2026-111943 | NONE | — | 2026-10-21 | On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend… | |
| CVE-2026-6945 | NONE | — | 2026-10-20 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-112202 | NONE | Patched | — | 2026-10-20 | Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are u… |
| CVE-2026-85783 | NONE | Patched | — | 2026-10-20 | Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key… |
| CVE-2026-113812 | NONE | Patched | — | 2026-10-20 | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root C… |
| CVE-2026-113212 | NONE | — | 2026-10-20 | Memory corruption in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2026-113196 | NONE | — | 2026-10-20 | Improper access control in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… | |
| CVE-2026-108518 | NONE | Patched | — | 2026-10-20 | DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} eleme… |
| CVE-2026-111879 | NONE | Patched | — | 2026-10-20 | DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's loc… |
| CVE-2025-60475 | NONE | Patched | — | 2026-10-20 | A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via sup… |
| CVE-2025-60494 | NONE | Patched | — | 2026-10-20 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servi… |
| CVE-2025-60496 | NONE | Patched | — | 2026-10-20 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service … |
| CVE-2026-94265 | NONE | — | 2026-10-20 | When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Nego… | |
| CVE-2026-94266 | NONE | — | 2026-10-20 | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl … | |
| CVE-2026-92386 | NONE | — | 2026-10-20 | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Conseque… | |
| CVE-2026-92387 | NONE | — | 2026-10-20 | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeo… | |
| CVE-2026-92388 | NONE | — | 2026-10-20 | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser… |