Export limit exceeded: 417640 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417640 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417640 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76932 | 1 Hitachi | 3 Jp1/automatic Job Management System 3 - Agent, Jp1/automatic Job Management System 3 - Agent Minimal Edition, Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.4 Critical |
| Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31. | ||||
| CVE-2026-63402 | 1 I18next | 1 I18next | 2026-10-30 | 5.9 Medium |
| i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4. | ||||
| CVE-2026-76934 | 1 Hitachi | 3 Jp1/automatic Job Management System 3 - Agent, Jp1/automatic Job Management System 3 - Agent Minimal Edition, Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.8 Critical |
| Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31. | ||||
| CVE-2026-76935 | 1 Hitachi | 1 Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.4 Critical |
| Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31. | ||||
| CVE-2026-76938 | 1 Hitachi | 1 Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.8 Critical |
| Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31. | ||||
| CVE-2026-76937 | 1 Hitachi | 1 Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.4 Critical |
| Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31. | ||||
| CVE-2026-76936 | 1 Hitachi | 1 Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.4 Critical |
| Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31. | ||||
| CVE-2026-76939 | 1 Hitachi | 2 Jp1/automatic Job Management System 3 - Agent, Jp1/automatic Job Management System 3 - Manager | 2026-10-30 | 9.8 Critical |
| Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31. | ||||
| CVE-2026-82122 | 1 Hitachi | 2 Hirdb Server, Hirdb Server With Additional Function | 2026-10-30 | 9.4 Critical |
| Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-82121 | 1 Hitachi | 2 Hirdb Server, Hirdb Server With Additional Function | 2026-10-30 | 7.5 High |
| Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-82119 | 1 Hitachi | 2 Hirdb Server, Hirdb Server With Additional Function | 2026-10-30 | 9.8 Critical |
| OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-82120 | 1 Hitachi | 3 Hirdb Server, Hirdb Server Version, Hirdb Server With Additional Function | 2026-10-30 | 9.8 Critical |
| Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-82118 | 1 Hitachi | 2 Hirdb Server, Hirdb Server With Additional Function | 2026-10-30 | 9.8 Critical |
| Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-82116 | 1 Hitachi | 2 Hirdb Server, Hirdb Server With Additional Function | 2026-10-30 | 9.8 Critical |
| Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-82117 | 1 Hitachi | 2 Hirdb Server, Hirdb Server With Additional Function | 2026-10-30 | 9.8 Critical |
| Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V. | ||||
| CVE-2026-13162 | 1 Hitachienergy | 2 Coretec 4, Coretec 5 | 2026-10-30 | N/A |
| An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation. | ||||
| CVE-2026-61847 | 1 Rgrove | 1 Crass | 2026-10-30 | 7.5 High |
| Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7. | ||||
| CVE-2026-112353 | 1 Gfi | 1 Kerio Connect | 2026-10-30 | 8.2 High |
| GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer. | ||||
| CVE-2026-119339 | 2026-10-30 | 5.5 Medium | ||
| Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4. | ||||
| CVE-2026-118667 | 1 Langchain-ai | 2 Langgraph, Langgraph-sdk | 2026-10-30 | 4.3 Medium |
| LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14. | ||||