Export limit exceeded: 424331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424331 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124000 | 1 Nasajpl | 1 Iondtn | 2026-11-11 | 5.3 Medium |
| NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages that are processed without cryptographic authentication. Attackers can exploit the insufficient buffer size calculation for the internal state-event object to crash the active Configuration Server thread, causing a denial of service and potentially destabilizing subsequent shared-memory allocations in amsd. | ||||
| CVE-2026-124001 | 1 Nasajpl | 1 Iondtn | 2026-11-11 | 8.1 High |
| NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution. | ||||
| CVE-2026-123804 | 1 Supertokens | 1 Supertokens | 2026-11-11 | 6.8 Medium |
| SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. | ||||
| CVE-2026-119078 | 1 Apache | 1 Commons Codec | 2026-11-11 | N/A |
| Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns the same bytes. The key-derivation example in the class Javadoc, shipped since 1.16.0, derives two keys with two consecutive doFinalize calls. Code that follows it gets identical keys, so the separation between the derived keys is lost. The same applies to any application that calls doFinalize more than once on one instance and expects new output each time. This issue affects Apache Commons Codec from 1.16.0 before 1.23.0. Version 1.23.0 corrects the documentation, but the behavior of doFinalize is unchanged. Upgrading alone does not fix affected code. Users should check their applications for repeated doFinalize calls on the same Blake3 instance and derive multiple keys by requesting the combined length in one call and splitting the output, as the updated Javadoc shows. | ||||
| CVE-2026-106007 | 1 Wordpress-extensions | 1 Fraudlabs Pro Sms Verification | 2026-11-11 | 5.3 Medium |
| The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties. | ||||
| CVE-2026-108186 | 1 Zoom Communications | 1 Zoom Workplace | 2026-11-11 | 9.6 Critical |
| Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. | ||||
| CVE-2026-108404 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-11 | 6.8 Medium |
| Heap-based buffer overflow in Windows CD-ROM Driver allows an unauthorized attacker to execute code with a physical attack. | ||||
| CVE-2026-108423 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-11 | 4.7 Medium |
| Out-of-bounds read in Windows WinHTTP allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-100290 | 2026-11-11 | 3.7 Low | ||
| The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library. | ||||
| CVE-2026-64855 | 2026-11-11 | 8.2 High | ||
| soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0. | ||||
| CVE-2026-96760 | 1 Authlib | 1 Authlib | 2026-11-11 | 9.8 Critical |
| Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. | ||||
| CVE-2025-43537 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-11 | 3.5 Low |
| A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2. Restoring a maliciously crafted backup file may lead to modification of protected system files. | ||||
| CVE-2025-66367 | 1 Samsung Semiconductor | 18 Exynos 1280, Exynos 1330, Exynos 1380 and 15 more | 2026-11-11 | 7.5 High |
| Improper handling of NAS DLTransport messages may lead to a baseband crash. | ||||
| CVE-2025-66366 | 1 Samsung Semiconductor | 10 Exynos 1280, Exynos 1330, Exynos 1380 and 7 more | 2026-11-11 | 7.5 High |
| Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash | ||||
| CVE-2026-101275 | 2026-11-11 | N/A | ||
| Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment. | ||||
| CVE-2026-105425 | 1 Ivanti | 2 Endpoint Manager Mobile, Sentry | 2026-11-11 | 7.2 High |
| OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | ||||
| CVE-2026-105426 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-11-11 | 6.7 Medium |
| Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root. | ||||
| CVE-2026-105427 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-11-11 | 4.9 Medium |
| Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service. | ||||
| CVE-2026-102803 | 1 J2commerce.com | 1 J2store Extension For Joomla | 2026-11-11 | N/A |
| Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state. | ||||
| CVE-2026-102200 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-11 | 4.7 Medium |
| Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an authorized attacker to perform tampering locally. | ||||