Export limit exceeded: 423522 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423522 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109849 | 1 Ntt Data Intellilink Corporation | 1 Hinemos | 2026-11-06 | 6.5 Medium |
| Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user. | ||||
| CVE-2025-66365 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| Incorrect handling of SIP packets leads to baseband crashes | ||||
| CVE-2026-122992 | 1 G4klx | 1 Dstargateway | 2026-11-06 | N/A |
| In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field. | ||||
| CVE-2026-123851 | 1 Jetbrains | 1 Junie Github Action | 2026-11-06 | 5.4 Medium |
| In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters | ||||
| CVE-2026-123846 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 4.3 Medium |
| In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation | ||||
| CVE-2026-123840 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 4.7 Medium |
| In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs | ||||
| CVE-2026-123836 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 8.8 High |
| In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup | ||||
| CVE-2026-123834 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 7.5 High |
| In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account | ||||
| CVE-2026-122193 | 1 Aws | 1 Trusted-remote-execution | 2026-11-06 | 9.9 Critical |
| OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement. To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run. | ||||
| CVE-2026-106128 | 1 Progress | 1 Kendo Ui For Vue | 2026-11-06 | 4.1 Medium |
| Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability. | ||||
| CVE-2026-101533 | 1 Oracle | 1 Edi Gateway | 2026-11-06 | 6.6 Medium |
| Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2024-6409 | 1 Redhat | 5 Enterprise Linux, Openshift, Rhel E4s and 2 more | 2026-11-06 | 7 High |
| A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server. | ||||
| CVE-2026-48175 | 1 Samsung Semiconductor | 11 Exynos 1280, Exynos 1330, Exynos 1380 and 8 more | 2026-11-06 | 5.5 Medium |
| Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. | ||||
| CVE-2026-123010 | 1 Twilio-labs | 1 Netlify-okta-auth | 2026-11-06 | 7.2 High |
| @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set. | ||||
| CVE-2026-106022 | 1 Johnsoncontrols | 1 Easyio Neo Iomanager And Tools Installer | 2026-11-06 | N/A |
| Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retrieve Embedded Sensitive Data. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0. | ||||
| CVE-2026-123859 | 2026-11-06 | 8.1 High | ||
| When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, which could allow SQL injection. In both products, a crafted column name could have been used to chain additional SQL statements onto the generated statement, potentially allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role. Exploitation required an application to pass attacker controlled column names into this functionality. The fix is available in Snowflake Connector for Python version 4.8.1 and Snowflake Connector for Python (Universal Core) version 5.2.0. Users must upgrade manually. | ||||
| CVE-2026-106020 | 1 Johnsoncontrols | 1 Easyio Neo Io Manager And Tools Installer | 2026-11-06 | N/A |
| Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking. This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0. | ||||
| CVE-2026-19876 | 1 Infinitt Healthcare | 1 Infinitt Ulite | 2026-11-06 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50. | ||||
| CVE-2026-19877 | 1 Infinitt Healthcare | 1 Infinitt Ulite | 2026-11-06 | 7.5 High |
| INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50. | ||||
| CVE-2026-64894 | 1 Johnsoncontrols | 1 Easyio Neo Iomanager And Tools Installer | 2026-11-06 | N/A |
| Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0. | ||||