Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
168,566 matching · page 57/3372Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-111733(opens NVD record) | Unscored | — | P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device (denial of service). | Oct 29, 2026 |
| CVE-2026-111732(opens NVD record) | Unscored | — | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default. | Oct 29, 2026 |
| CVE-2026-111731(opens NVD record) | Unscored | — | P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use this to cause a denial of service. | Oct 29, 2026 |
| CVE-2026-111730(opens NVD record) | Unscored | — | P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution. Requires establishment of session that needs ADJACENT network access. | Oct 29, 2026 |
| CVE-2026-110309(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. | Oct 29, 2026 |
| CVE-2026-110245(opens NVD record) | High | 7.5 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication. | Oct 29, 2026 |
| CVE-2026-110244(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | Oct 29, 2026 |
| CVE-2026-110200(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information. | Oct 29, 2026 |
| CVE-2026-110196(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. | Oct 29, 2026 |
| CVE-2026-110193(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server. | Oct 29, 2026 |
| CVE-2026-110192(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. | Oct 29, 2026 |
| CVE-2026-110190(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system. | Oct 29, 2026 |
| CVE-2026-110186(opens NVD record) | Critical | 9.8 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | Oct 29, 2026 |
| CVE-2026-109891(opens NVD record) | Medium | 6.4 | Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1. | Oct 29, 2026 |
| CVE-2026-108494(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. | Oct 29, 2026 |
| CVE-2026-107329(opens NVD record) | Critical | 9.9 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | Oct 29, 2026 |
| CVE-2026-107328(opens NVD record) | Critical | 9.9 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. | Oct 29, 2026 |
| CVE-2026-107327(opens NVD record) | Critical | 9.9 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. | Oct 29, 2026 |
| CVE-2026-107326(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | Oct 29, 2026 |
| CVE-2026-107042(opens NVD record) | High | 7.5 | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI. | Oct 29, 2026 |
| CVE-2026-107041(opens NVD record) | High | 7.5 | Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS). | Oct 29, 2026 |
| CVE-2026-107040(opens NVD record) | Critical | 9.1 | Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | Oct 29, 2026 |
| CVE-2026-107039(opens NVD record) | High | 7.5 | Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS). | Oct 29, 2026 |
| CVE-2026-107038(opens NVD record) | Critical | 9.1 | Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data. | Oct 29, 2026 |
| CVE-2026-107037(opens NVD record) | High | 7.5 | Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id. | Oct 29, 2026 |
| CVE-2026-107036(opens NVD record) | Medium | 5.1 | Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application. | Oct 29, 2026 |
| CVE-2026-107035(opens NVD record) | Medium | 6.5 | Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload. | Oct 29, 2026 |
| CVE-2026-107034(opens NVD record) | Critical | 9.1 | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data. | Oct 29, 2026 |
| CVE-2026-107033(opens NVD record) | Medium | 6.5 | Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database. | Oct 29, 2026 |
| CVE-2026-107032(opens NVD record) | Critical | 9.1 | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | Oct 29, 2026 |
| CVE-2026-107030(opens NVD record) | High | 7.5 | Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing. | Oct 29, 2026 |
| CVE-2026-107029(opens NVD record) | Critical | 9.1 | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | Oct 29, 2026 |
| CVE-2026-107028(opens NVD record) | Critical | 9.1 | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data. | Oct 29, 2026 |
| CVE-2026-107027(opens NVD record) | Critical | 9.1 | Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | Oct 29, 2026 |
| CVE-2026-107026(opens NVD record) | High | 7.5 | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content. | Oct 29, 2026 |
| CVE-2026-107025(opens NVD record) | High | 7.5 | Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data. | Oct 29, 2026 |
| CVE-2026-106036(opens NVD record) | Unscored | — | Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708. | Oct 29, 2026 |
| CVE-2026-104339(opens NVD record) | Critical | 9.8 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | Oct 29, 2026 |
| CVE-2026-104331(opens NVD record) | Medium | 5.4 | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | Oct 29, 2026 |
| CVE-2026-104328(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | Oct 29, 2026 |
| CVE-2026-104324(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data. | Oct 29, 2026 |
| CVE-2026-104317(opens NVD record) | High | 8.1 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | Oct 29, 2026 |
| CVE-2026-104316(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check. | Oct 29, 2026 |
| CVE-2026-104315(opens NVD record) | Medium | 4.3 | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | Oct 29, 2026 |
| CVE-2026-104314(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response. | Oct 29, 2026 |
| CVE-2026-104312(opens NVD record) | Low | 3.5 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's host. | Oct 29, 2026 |
| CVE-2026-104310(opens NVD record) | Medium | 4.3 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability. | Oct 29, 2026 |
| CVE-2026-104309(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | Oct 29, 2026 |
| CVE-2026-104308(opens NVD record) | Medium | 4.3 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command. | Oct 29, 2026 |
| CVE-2026-103092(opens NVD record) | High | 8.5 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. | Oct 29, 2026 |