Export limit exceeded: 419424 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419424 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419424 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419424 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 51453 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419424 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419424 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116192 | 1 Rclone | 1 Rclone | 2026-11-04 | 5.9 Medium |
| rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures. | ||||
| CVE-2026-116164 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-04 | N/A |
| Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies. | ||||
| CVE-2026-115326 | 1 Webkul | 1 Qloapps | 2026-11-04 | 5.4 Medium |
| QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities. | ||||
| CVE-2026-115216 | 1 Eclipse | 1 Eclipse Iofog | 2026-11-04 | N/A |
| In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret. | ||||
| CVE-2026-113644 | 1 Eclipse | 1 Eclipse Iofog | 2026-11-04 | N/A |
| In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2. | ||||
| CVE-2026-10537 | 1 Bmc | 2 Control-m/enterprise Manager, Control-m/server | 2026-11-04 | 5.3 Medium |
| A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions | ||||
| CVE-2026-109088 | 1 X.org | 1 Libxtst | 2026-11-04 | 6.5 Medium |
| A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop. | ||||
| CVE-2026-108313 | 1 Tanium | 1 Tanium Server | 2026-11-04 | 6.6 Medium |
| Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. | ||||
| CVE-2026-108309 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Performance | 2026-11-04 | 5.5 Medium |
| Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. | ||||
| CVE-2026-108304 | 1 Tanium | 2 End-user-cx, Endpoint Configuration Toolset Solution | 2026-11-04 | 7.8 High |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-108141 | 1 Veeam | 1 Backup And Replication | 2026-11-04 | N/A |
| A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. | ||||
| CVE-2026-107671 | 1 Veeam | 1 One | 2026-11-04 | N/A |
| A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. | ||||
| CVE-2026-105987 | 1 Kgs Software | 1 Tia Viewer | 2026-11-04 | N/A |
| KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8. | ||||
| CVE-2026-105323 | 1 Kulga Software And Telecommunications Limited Company | 1 Kulga News Software | 2026-11-04 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0. | ||||
| CVE-2025-64394 | 1 Veeam | 1 Backup For Microsoft 365 | 2026-11-04 | N/A |
| A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service. | ||||
| CVE-2026-121929 | 1 Empiresoft | 1 Empirecms | 2026-11-04 | 3.5 Low |
| A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-112665 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-04 | 3.3 Low |
| An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to determine kernel memory layout. | ||||
| CVE-2026-112624 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-04 | 5.1 Medium |
| This issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to bypass Privacy preferences. | ||||
| CVE-2026-86943 | 1 Apple | 1 Macos | 2026-11-04 | 7.5 High |
| The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause a denial-of-service. | ||||
| CVE-2026-112518 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-11-04 | 6.3 Medium |
| An issue with signature validation was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in a privileged network position may be able to impersonate a Kerberos KDC. | ||||