Export limit exceeded: 417482 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417482 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417482 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86696 | 3 Arekinath, Dropbox, Handnot2 | 3 Esaml, Esaml, Esaml | 2026-10-30 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward. | ||||
| CVE-2026-79867 | 1 Hpe | 1 Aos | 2026-10-30 | 9.6 Critical |
| Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | ||||
| CVE-2026-79864 | 1 Hpe | 1 Aos | 2026-10-30 | 9.6 Critical |
| Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-79863 | 1 Hpe | 1 Aos | 2026-10-30 | 9.6 Critical |
| Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. | ||||
| CVE-2026-79862 | 1 Hpe | 1 Aos | 2026-10-30 | 9.6 Critical |
| Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. | ||||
| CVE-2026-79861 | 2026-10-30 | 9.8 Critical | ||
| There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. | ||||
| CVE-2026-79860 | 1 Hpe | 1 Aos | 2026-10-30 | 9.8 Critical |
| Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. | ||||
| CVE-2026-79859 | 1 Hpe | 1 Aos | 2026-10-30 | 9.8 Critical |
| Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. | ||||
| CVE-2026-76529 | 1 Splunk | 1 Splunk | 2026-10-30 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76529 are related to improper protection of alternate path and are grouped under the Common Weakness Enumeration (CWE) CWE-424. | ||||
| CVE-2026-76408 | 1 Splunk | 1 Splunk | 2026-10-30 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76408 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664. | ||||
| CVE-2026-76012 | 2 Smub, Wordpress-extensions | 2 Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery, Nextgen Gallery | 2026-10-30 | 7.5 High |
| The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps. | ||||
| CVE-2026-69446 | 1 Microsoft | 2 Edge Chromium, Microsoft Edge (chromium-based) | 2026-10-30 | 4.4 Medium |
| Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62131 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | ||||
| CVE-2026-62016 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | ||||
| CVE-2026-62015 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | ||||
| CVE-2026-62014 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | ||||
| CVE-2026-62011 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | ||||
| CVE-2026-62010 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | ||||
| CVE-2026-62009 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | ||||
| CVE-2026-62005 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | ||||