Export limit exceeded: 109499 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109499 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-101786 | 1 Oracle | 2 Mysql Cluster, Mysql Server | 2026-10-22 | 7.2 High |
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-110621 | 1 Swetrix | 1 Swetrix | 2026-10-22 | 8.8 High |
| Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it. | ||||
| CVE-2026-87395 | 1 Oracle | 1 Outside In Technology | 2026-10-22 | 7.5 High |
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). | ||||
| CVE-2026-65103 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 8.1 High |
| NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service. | ||||
| CVE-2026-65161 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 7.5 High |
| NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure. | ||||
| CVE-2026-65170 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 8.6 High |
| NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure. | ||||
| CVE-2026-65101 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 8.6 High |
| NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure. | ||||
| CVE-2026-65164 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 8.1 High |
| NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service. | ||||
| CVE-2026-65172 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 8.6 High |
| NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines. | ||||
| CVE-2026-110359 | 1 Hyland | 1 Desktop Host | 2026-10-22 | 7.8 High |
| Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges. | ||||
| CVE-2026-79821 | 1 Hpe | 1 Nonstop Soap 4.0 | 2026-10-22 | 8.2 High |
| A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down. | ||||
| CVE-2026-79824 | 1 Hpe | 1 Nonstop Python 3.x | 2026-10-22 | 8 High |
| A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive. | ||||
| CVE-2026-79825 | 1 Hpe | 1 Nonstop Ndsrest | 2026-10-22 | 7.1 High |
| A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-79826 | 1 Hpe | 1 Nonstop Ocax | 2026-10-22 | 7.1 High |
| A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. | ||||
| CVE-2026-79840 | 1 Hpe | 1 Nonstop Xabroker | 2026-10-22 | 7.3 High |
| A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash. | ||||
| CVE-2026-110899 | 2 Kevin Stover, Wordpress-extensions | 2 Ninja Forms, Ninja Forms | 2026-10-22 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5. | ||||
| CVE-2026-114510 | 1 Stevereiner | 1 Flexible-graphrag | 2026-10-22 | 7.1 High |
| Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2. | ||||
| CVE-2026-113582 | 1 Apache | 1 Abdera | 2026-10-22 | 7.5 High |
| UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-112780 | 1 Getgrav | 1 Grav | 2026-10-22 | 8.8 High |
| Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files. | ||||
| CVE-2026-112775 | 1 Craftcms | 1 Craft Cms | 2026-10-22 | 7.5 High |
| Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account. | ||||