Search
14,262 CVEs · Medium severity
CVEs (14,262, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 14,262 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-112249 | MEDIUM | 2.4 | 2026-10-19 | A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml… | |
| CVE-2026-109410 | MEDIUM | 2.4 | 2026-10-13 | A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInf… | |
| CVE-2026-111888 | MEDIUM | Patched | 2.7 | 2026-10-17 | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /ad… |
| CVE-2026-111648 | MEDIUM | 2.7 | 2026-10-16 | BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profile… | |
| CVE-2026-110225 | MEDIUM | 2.7 | 2026-10-13 | Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookma… | |
| CVE-2026-105164 | MEDIUM | 2.7 | 2026-10-04 | A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulatio… | |
| CVE-2026-103287 | MEDIUM | Patched | 2.7 | 2026-10-01 | Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers w… |
| CVE-2026-90916 | MEDIUM | Patched | 2.7 | 2026-09-29 | Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized … |
| CVE-2026-101991 | MEDIUM | 3.1 | 2026-10-14 | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configu… | |
| CVE-2026-115749 | MEDIUM | Patched | 3.3 | 2026-10-23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passi… |
| CVE-2026-113609 | MEDIUM | Patched | 3.3 | 2026-10-20 | Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attacker… |
| CVE-2026-112284 | MEDIUM | 3.3 | 2026-10-19 | libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound … | |
| CVE-2026-111926 | MEDIUM | Patched | 3.3 | 2026-10-17 | Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including te… |
| CVE-2026-111678 | MEDIUM | Patched | 3.3 | 2026-10-16 | Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounde… |
| CVE-2026-110661 | MEDIUM | 3.3 | 2026-10-14 | CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node head… | |
| CVE-2026-110657 | MEDIUM | 3.3 | 2026-10-14 | Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory… | |
| CVE-2026-110660 | MEDIUM | 3.3 | 2026-10-14 | vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_… | |
| CVE-2026-110606 | MEDIUM | 3.3 | 2026-10-14 | LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strl… | |
| CVE-2026-110262 | MEDIUM | Patched | 3.3 | 2026-10-14 | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted … |
| CVE-2024-58392 | MEDIUM | 3.3 | 2026-10-14 | PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor ad… | |
| CVE-2026-110232 | MEDIUM | 3.3 | 2026-10-13 | Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an una… | |
| CVE-2026-109603 | MEDIUM | Patched | 3.3 | 2026-10-12 | Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forger… |
| CVE-2026-109277 | MEDIUM | Patched | 3.3 | 2026-10-12 | ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script… |
| CVE-2026-109270 | MEDIUM | Patched | 3.3 | 2026-10-12 | ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain ar… |
| CVE-2026-108857 | MEDIUM | 3.3 | 2026-10-11 | Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a… |