Export limit exceeded: 425829 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425829 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63151 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 7.5 High |
| Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication. | ||||
| CVE-2026-63164 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 6.5 Medium |
| Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications. | ||||
| CVE-2026-63170 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 3.7 Low |
| Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization. | ||||
| CVE-2026-20571 | 2 Mediatek, Mediatek, Inc. | 84 Mediatek Chipset, Mt6739, Mt6739 Firmware and 81 more | 2026-11-13 | 6.7 Medium |
| In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11434319; Issue ID: MSV-9925. | ||||
| CVE-2026-20570 | 2 Mediatek, Mediatek, Inc. | 42 Mediatek Chipset, Mt6858, Mt6858 Firmware and 39 more | 2026-11-13 | 6.7 Medium |
| In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926. | ||||
| CVE-2026-20569 | 2 Mediatek, Mediatek, Inc. | 42 Mediatek Chipset, Mt6858, Mt6858 Firmware and 39 more | 2026-11-13 | 6.7 Medium |
| In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927. | ||||
| CVE-2026-20568 | 2 Mediatek, Mediatek, Inc. | 84 Mediatek Chipset, Mt6739, Mt6739 Firmware and 81 more | 2026-11-13 | 6.7 Medium |
| In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003. | ||||
| CVE-2026-121047 | 1 Google | 1 Chrome | 2026-11-13 | 8.8 High |
| Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-123710 | 1 Redhat | 2 Mirror Registry, Quay | 2026-11-13 | 9.8 Critical |
| A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags. | ||||
| CVE-2026-110697 | 1 Redhat | 2 Mirror Registry, Quay | 2026-11-13 | 9.9 Critical |
| A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations. | ||||
| CVE-2026-20320 | 1 Cisco | 5 Broadworks, Broadworks Application Delivery Platform, Broadworks Application Server and 2 more | 2026-11-13 | 7.5 High |
| A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user. | ||||
| CVE-2026-128133 | 2026-11-13 | N/A | ||
| This CVE is a duplicate of another CVE. | ||||
| CVE-2026-82504 | 2026-11-13 | 9.8 Critical | ||
| VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+. | ||||
| CVE-2026-28248 | 2026-11-13 | N/A | ||
| Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially launch a guest whose attestation report contains an ID key digest for an ID block that doesn't match the guest's measurement resulting in loss of integrity. | ||||
| CVE-2026-126261 | 1 Fortinet | 1 Fortimanager | 2026-11-13 | 9 Critical |
| A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets. | ||||
| CVE-2026-129172 | 1 Tianma-if | 1 Edgeever | 2026-11-13 | 5.4 Medium |
| EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes. | ||||
| CVE-2026-129170 | 1 Vastsa | 1 Filecodebox | 2026-11-13 | 6.1 Medium |
| FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage. | ||||
| CVE-2026-129156 | 1 Liangliangyy | 1 Djangoblog | 2026-11-13 | 5.4 Medium |
| DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers. | ||||
| CVE-2026-129155 | 1 Liangliangyy | 1 Djangoblog | 2026-11-13 | 5.4 Medium |
| DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators. | ||||
| CVE-2026-129154 | 2 Javahuang, Surveyking | 2 Surveyking, Surveyking | 2026-11-13 | 6.1 Medium |
| SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed. | ||||