Export limit exceeded: 418405 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10578 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113721 | 1 Pypa | 1 Virtualenv | 2026-10-28 | 4.5 Medium |
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user's permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9. | ||||
| CVE-2026-115968 | 2 Ultimatemember, Wordpress-extensions | 2 Ultimate Member, Ultimate Member | 2026-10-28 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1. | ||||
| CVE-2026-87348 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-28 | 4.2 Medium |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). | ||||
| CVE-2026-115912 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-10-28 | 7.5 High |
| vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0. | ||||
| CVE-2026-111762 | 1 A2aproject | 1 A2a-java | 2026-10-28 | N/A |
| A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java` logs the entire JSON request body at SEVERE level when JsonFormat.parser().merge() throws InvalidProtocolBufferException. With push notifications enabled, createTaskPushNotificationConfiguration reaches this parser for requests to `/v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs`, whose token and authentication.credentials fields can contain bearer tokens and authentication credentials for client push endpoints. A valid JSON body that fails protobuf deserialization, including an unknown field under strict parsing or a schema mismatch, causes those secrets to be written to the server logs in cleartext. An attacker with access to the server logs or a log aggregation system can retrieve the credentials and potentially use the credentials to send forged task status updates to the client's push notification endpoint. This issue is fixed in version 1.3.0.Final. | ||||
| CVE-2026-118174 | 1 Mozilla | 1 Thunderbird | 2026-10-28 | 4.3 Medium |
| When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | ||||
| CVE-2026-114096 | 1 Dulwich Project | 1 Dulwich | 2026-10-28 | 7.8 High |
| Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution. | ||||
| CVE-2026-87097 | 1 Acronis | 1 Acronis Cyber Protect 17 | 2026-10-28 | N/A |
| Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587. | ||||
| CVE-2026-29001 | 1 Tastyigniter | 1 Tastyigniter | 2026-10-28 | 7.2 High |
| TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten. | ||||
| CVE-2026-110879 | 2026-10-28 | 9.8 Critical | ||
| jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512 (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric() checks the outer class against the declared base type and then passes each argument from the type ID to _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing its corresponding declared generic binding. It also invokes validators with arguments that have not passed the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID. Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's base type is approved. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that expose that default typing. The default-validator case requires no application-authored validator: with @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as "Not a subtype", while a type ID naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied bean properties. Where class-name default typing permits Map, a property declared as Map<String,String> accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath and attacker-controlled XML the application can load, that constructor loads the XML and invokes ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in jackson-databind 2.10.0. | ||||
| CVE-2026-114098 | 2 Dulwich Project, Jelmer | 2 Dulwich, Dulwich | 2026-10-27 | 7.8 High |
| Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout. | ||||
| CVE-2026-114073 | 1 Triggerdotdev | 1 Trigger.dev | 2026-10-27 | 5.5 Medium |
| Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials. | ||||
| CVE-2026-19600 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2026-10-27 | 4.5 Medium |
| Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763 | ||||
| CVE-2026-108304 | 1 Tanium | 2 End-user-cx, Endpoint Configuration Toolset Solution | 2026-10-27 | 7.8 High |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-108328 | 1 Tanium | 1 Threat Response | 2026-10-27 | 4.2 Medium |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. | ||||
| CVE-2026-108306 | 1 Tanium | 2 End-user-cx, Endpoint Configuration Toolset Solution | 2026-10-27 | 7.8 High |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-108305 | 1 Tanium | 2 End-user-cx, Endpoint Configuration Toolset Solution | 2026-10-27 | 7.8 High |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-108325 | 1 Tanium | 1 Reputation | 2026-10-27 | 6.6 Medium |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. | ||||
| CVE-2026-90464 | 1 Watchguard | 1 Fireware Os | 2026-10-27 | N/A |
| An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values. | ||||
| CVE-2026-113713 | 1 Pypa | 1 Virtualenv | 2026-10-27 | 6.7 Medium |
| virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10. | ||||