Export limit exceeded: 412519 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412519 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412519 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113776 | 2026-10-20 | 7.8 High | ||
| virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2. | ||||
| CVE-2026-9825 | 1 Ibm | 1 Cyber Fraud | 2026-10-20 | 3.7 Low |
| IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks. | ||||
| CVE-2026-113732 | 2026-10-20 | 7.8 High | ||
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2. | ||||
| CVE-2026-113704 | 1 A2aproject | 1 A2a-rs | 2026-10-20 | 7.3 High |
| A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue. | ||||
| CVE-2026-43834 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution. | ||||
| CVE-2026-43838 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | ||||
| CVE-2026-43848 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. | ||||
| CVE-2026-43850 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. | ||||
| CVE-2026-43852 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system. | ||||
| CVE-2026-43853 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash. | ||||
| CVE-2026-43854 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices. | ||||
| CVE-2026-43856 | 1 Advantech | 1 Adam-3600 | 2026-10-20 | N/A |
| A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes. | ||||
| CVE-2026-111758 | 2026-10-20 | 7.5 High | ||
| markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3. | ||||
| CVE-2026-81212 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-20 | 10 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters. | ||||
| CVE-2026-82891 | 1 Ibm | 1 Guardium Data Protection | 2026-10-20 | 8.1 High |
| IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. | ||||
| CVE-2026-87800 | 1 Ibm | 1 Cyber Fraud | 2026-10-20 | 6.8 Medium |
| IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type. | ||||
| CVE-2026-92559 | 1 Ibm | 1 App Connect Enterprise | 2026-10-20 | 9.8 Critical |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. | ||||
| CVE-2026-93441 | 1 Ibm | 1 Qradar Security Information And Event Management | 2026-10-20 | 8.6 High |
| IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||
| CVE-2026-93442 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2026-10-20 | 8.2 High |
| IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read. | ||||
| CVE-2026-113713 | 1 Pypa | 1 Virtualenv | 2026-10-20 | 6.7 Medium |
| virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10. | ||||