Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
95,805 matching · page 10/1917Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-121382(opens NVD record) | High | 7.5 | A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | Nov 3, 2026 |
| CVE-2026-120956(opens NVD record) | High | 7.1 | The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver. | Nov 3, 2026 |
| CVE-2026-120955(opens NVD record) | High | 7.5 | The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API. | Nov 3, 2026 |
| CVE-2026-120954(opens NVD record) | Low | 3.7 | A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed. | Nov 3, 2026 |
| CVE-2026-120953(opens NVD record) | Medium | 4.3 | A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required. | Nov 3, 2026 |
| CVE-2026-120684(opens NVD record) | Medium | 6.5 | A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials. | Nov 3, 2026 |
| CVE-2026-120678(opens NVD record) | High | 7.5 | A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required. | Nov 3, 2026 |
| CVE-2026-120673(opens NVD record) | Medium | 5.5 | A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data. | Nov 3, 2026 |
| CVE-2026-119922(opens NVD record) | High | 8.8 | Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. | Nov 3, 2026 |
| CVE-2026-112917(opens NVD record) | Unscored | — | In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected. | Nov 3, 2026 |
| CVE-2026-63499(opens NVD record) | Unscored | — | zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1. | Nov 3, 2026 |
| CVE-2026-63494(opens NVD record) | Unscored | — | Rejected reason: This CVE is a duplicate of another CVE. | Nov 3, 2026 |
| CVE-2026-63492(opens NVD record) | Unscored | — | Rejected reason: This CVE is a duplicate of another CVE. | Nov 3, 2026 |
| CVE-2026-63436(opens NVD record) | Medium | 6.1 | zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0. | Nov 3, 2026 |
| CVE-2026-63418(opens NVD record) | High | 7.0 | Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1. | Nov 3, 2026 |
| CVE-2026-44267(opens NVD record) | Critical | 9.8 | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1. | Nov 3, 2026 |
| CVE-2026-44266(opens NVD record) | Critical | 9.8 | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1. | Nov 3, 2026 |
| CVE-2026-44265(opens NVD record) | High | 7.4 | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1. | Nov 3, 2026 |
| CVE-2026-121628(opens NVD record) | Low | 3.7 | Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly. | Nov 3, 2026 |
| CVE-2026-121627(opens NVD record) | Medium | 6.1 | buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials. | Nov 3, 2026 |
| CVE-2026-121626(opens NVD record) | Low | 3.7 | GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper. | Nov 3, 2026 |
| CVE-2026-121625(opens NVD record) | Low | 3.7 | GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper. | Nov 3, 2026 |
| CVE-2026-121624(opens NVD record) | Medium | 6.8 | Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes. | Nov 3, 2026 |
| CVE-2026-121263(opens NVD record) | Medium | 6.3 | A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | Nov 3, 2026 |
| CVE-2026-116845(opens NVD record) | Medium | 5.4 | NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them. | Nov 3, 2026 |
| CVE-2026-97072(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | Nov 3, 2026 |
| CVE-2026-39777(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0. | Nov 3, 2026 |
| CVE-2026-39743(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0. | Nov 3, 2026 |
| CVE-2026-38601(opens NVD record) | Unscored | — | A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies. | Nov 3, 2026 |
| CVE-2026-38600(opens NVD record) | Critical | 9.8 | A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive. | Nov 3, 2026 |
| CVE-2026-38595(opens NVD record) | Unscored | — | An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint. | Nov 3, 2026 |
| CVE-2026-28336(opens NVD record) | Critical | 9.9 | SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required. | Nov 3, 2026 |
| CVE-2026-28335(opens NVD record) | High | 8.4 | SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required. | Nov 3, 2026 |
| CVE-2026-28327(opens NVD record) | High | 8.2 | SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges. | Nov 3, 2026 |
| CVE-2026-121631(opens NVD record) | Medium | 4.2 | Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to. | Nov 3, 2026 |
| CVE-2026-121604(opens NVD record) | Low | 3.3 | wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC. | Nov 3, 2026 |
| CVE-2026-121603(opens NVD record) | Medium | 6.5 | Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution. | Nov 3, 2026 |
| CVE-2026-121602(opens NVD record) | Medium | 6.5 | Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution. | Nov 3, 2026 |
| CVE-2026-121588(opens NVD record) | Medium | 6.1 | TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials. | Nov 3, 2026 |
| CVE-2026-121587(opens NVD record) | Medium | 5.3 | Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification. | Nov 3, 2026 |
| CVE-2026-121262(opens NVD record) | Medium | 5.3 | A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | Nov 3, 2026 |
| CVE-2026-121261(opens NVD record) | Medium | 4.3 | A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | Nov 3, 2026 |
| CVE-2026-121259(opens NVD record) | Medium | 6.5 | A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service. | Nov 3, 2026 |
| CVE-2026-120846(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1. | Nov 3, 2026 |
| CVE-2026-120843(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14. | Nov 3, 2026 |
| CVE-2026-119675(opens NVD record) | High | 8.6 | MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1. | Nov 3, 2026 |
| CVE-2026-119674(opens NVD record) | Low | 3.7 | MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1. | Nov 3, 2026 |
| CVE-2026-119673(opens NVD record) | Low | 2.8 | MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1. | Nov 3, 2026 |
| CVE-2026-119672(opens NVD record) | Medium | 4.8 | MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1. | Nov 3, 2026 |
| CVE-2026-119521(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3. | Nov 3, 2026 |