Export limit exceeded: 425805 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425805 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425805 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425805 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95781 | 2026-11-14 | 7.5 High | ||
| A security vulnerability exists in AthonetOS that may allow an unauthorized party to affect service operation or gain access to certain protected system functions. Successful exploitation could result in a compromise of service integrity or unauthorized system access. | ||||
| CVE-2026-92544 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-14 | N/A |
| SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name. | ||||
| CVE-2026-92545 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-14 | N/A |
| The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another. | ||||
| CVE-2026-92443 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-14 | N/A |
| The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers. | ||||
| CVE-2026-92439 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-14 | N/A |
| The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong. | ||||
| CVE-2026-92441 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-14 | N/A |
| Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream. | ||||
| CVE-2026-92558 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-14 | N/A |
| The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route. | ||||
| CVE-2026-91871 | 2026-11-14 | 7.4 High | ||
| Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||
| CVE-2026-91872 | 2026-11-14 | 5.5 Medium | ||
| Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-91890 | 2026-11-14 | 8.7 High | ||
| Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access. | ||||
| CVE-2026-91879 | 2026-11-14 | 8.8 High | ||
| Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||
| CVE-2026-91874 | 2026-11-14 | 8.7 High | ||
| Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACConnection component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||
| CVE-2026-91876 | 2026-11-14 | 5.5 Medium | ||
| Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-91877 | 2026-11-14 | 7.6 High | ||
| Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service. | ||||
| CVE-2026-92379 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 5.4 Medium |
| An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files. | ||||
| CVE-2026-88266 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 4.3 Medium |
| An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. | ||||
| CVE-2026-126952 | 1 Diced | 1 Zipline | 2026-11-14 | 8.1 High |
| Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts. | ||||
| CVE-2026-126951 | 1 Diced | 1 Zipline | 2026-11-14 | N/A |
| Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow. | ||||
| CVE-2026-126950 | 1 Diced | 1 Zipline | 2026-11-14 | N/A |
| Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss. | ||||
| CVE-2026-127092 | 1 Build-admin | 1 Buildadmin | 2026-11-14 | 6.1 Medium |
| BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover. | ||||