Search
4,651 CVEs
EOL hidden · Show all products
CVEs (4,651, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 4,651 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115726 | HIGH | 7.8 | 2026-10-23 | Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded wi… | |
| CVE-2026-115725 | LOW | Patched | 4.2 | 2026-10-23 | Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sou… |
| CVE-2026-115724 | LOW | Patched | 2.9 | 2026-10-23 | VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachment… |
| CVE-2026-115723 | HIGH | 7.4 | 2026-10-23 | Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring… | |
| CVE-2026-115722 | MEDIUM | 6.1 | 2026-10-23 | RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Atta… | |
| CVE-2026-112904 | HIGH | 8.7 | 2026-10-23 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() fu… | |
| CVE-2026-111965 | MEDIUM | 4.3 | 2026-10-23 | The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass… | |
| CVE-2026-107685 | CRITICAL | Patched | — | 2026-10-23 | Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions… |
| CVE-2026-105963 | MEDIUM | Patched | — | 2026-10-23 | Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to exp… |
| CVE-2026-89320 | HIGH | — | 2026-10-23 | `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verifi… | |
| CVE-2026-89319 | MEDIUM | — | 2026-10-23 | `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics … | |
| CVE-2026-89318 | MEDIUM | — | 2026-10-23 | `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rath… | |
| CVE-2026-89317 | MEDIUM | — | 2026-10-23 | gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parame… | |
| CVE-2026-89316 | MEDIUM | — | 2026-10-23 | `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"… | |
| CVE-2026-89315 | MEDIUM | — | 2026-10-23 | `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **pani… | |
| CVE-2026-89314 | MEDIUM | — | 2026-10-23 | `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because t… | |
| CVE-2026-89313 | MEDIUM | — | 2026-10-23 | `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the traili… | |
| CVE-2026-89312 | MEDIUM | — | 2026-10-23 | `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an … | |
| CVE-2026-25784 | CRITICAL | Patched | 9.8 | 2026-10-23 | Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default … |
| CVE-2026-25716 | HIGH | Patched | 7.1 | 2026-10-23 | Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unbl… |
| CVE-2026-16762 | HIGH | — | 2026-10-23 | An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application… | |
| CVE-2026-115657 | MEDIUM | Patched | — | 2026-10-23 | When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during start… |
| CVE-2026-112862 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Databa… | |
| CVE-2026-112860 | CRITICAL | 9.3 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blin… | |
| CVE-2026-112838 | HIGH | 7.1 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects Vi… |