Export limit exceeded: 10516 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10516 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90861 | 2 Progress, Progress Software | 2 Ws Ftp Server, Ws Ftp Server | 2026-10-29 | 6.6 Medium |
| Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server. | ||||
| CVE-2026-119168 | 1 Hashicorp | 2 Nomad, Nomad Enterprise | 2026-10-29 | 8.8 High |
| HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. | ||||
| CVE-2026-87692 | 1 Microsoft | 8 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 5 more | 2026-10-29 | 7.8 High |
| Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119120 | 1 Unclecode | 1 Crawl4ai | 2026-10-29 | 7.5 High |
| Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory. | ||||
| CVE-2026-85840 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 6.5 Medium |
| Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-85849 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-29 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85857 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 5.5 Medium |
| Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-59158 | 1 Thoda-dev | 1 Nuxt-ollama | 2026-10-29 | 7.5 High |
| Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1. | ||||
| CVE-2026-83704 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-29 | 7.8 High |
| Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83659 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62017 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | ||||
| CVE-2026-62012 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | ||||
| CVE-2026-62006 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | ||||
| CVE-2026-62001 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | ||||
| CVE-2026-54858 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | ||||
| CVE-2026-46651 | 1 Intranda | 1 Goobi Viewer Core | 2026-10-29 | 9.8 Critical |
| The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05. | ||||
| CVE-2026-83933 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-29 | 5.5 Medium |
| Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-118080 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | ||||
| CVE-2026-118075 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | ||||
| CVE-2026-116867 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | ||||