Export limit exceeded: 402682 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (402682 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86243 | 1 Apache | 2 Apache Tomcat, Tomcat Native | 2026-10-06 | 7.5 High |
| Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue. | ||||
| CVE-2026-34498 | 1 Johnson Controls | 1 Illustra Standard - L4l China | 2026-10-06 | N/A |
| Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394. | ||||
| CVE-2026-86246 | 1 Apache | 2 Apache Tomcat, Tomcat Native | 2026-10-06 | 9.1 Critical |
| Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue. | ||||
| CVE-2026-86247 | 1 Apache | 2 Apache Tomcat, Tomcat Native | 2026-10-06 | 7.4 High |
| Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue. | ||||
| CVE-2026-100870 | 1 Sylius | 1 Sylius | 2026-10-06 | 8.8 High |
| Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts. | ||||
| CVE-2026-82924 | 2026-10-06 | 5.3 Medium | ||
| Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18. | ||||
| CVE-2026-105920 | 1 Kusalkasilva | 1 Learning-management-system | 2026-10-06 | 7.3 High |
| A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-82531 | 1 Newmediacompany | 1 Smarty | 2026-10-06 | 8.1 High |
| Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution. | ||||
| CVE-2026-57545 | 2026-10-06 | 7.8 High | ||
| Memory corruption when processing draw objects of incorrect type during graphics command list execution. | ||||
| CVE-2026-57537 | 2026-10-06 | 7.8 High | ||
| Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization. | ||||
| CVE-2026-56596 | 2026-10-06 | 3.5 Low | ||
| HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior. | ||||
| CVE-2026-25302 | 2026-10-06 | 7.1 High | ||
| Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed. | ||||
| CVE-2026-25291 | 2026-10-06 | 7.8 High | ||
| Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms. | ||||
| CVE-2026-25274 | 2026-10-06 | 6.7 Medium | ||
| Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization. | ||||
| CVE-2026-25273 | 2026-10-06 | 6.7 Medium | ||
| Memory Corruption when processing camera operations due to out-of-bounds write during driver updates. | ||||
| CVE-2026-25272 | 2026-10-06 | 6.7 Medium | ||
| Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation. | ||||
| CVE-2026-25270 | 2026-10-06 | 6.7 Medium | ||
| Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. | ||||
| CVE-2026-25267 | 2026-10-06 | 7.8 High | ||
| Memory corruption when non-secure loader rewrites page tables before secure memory initialization. | ||||
| CVE-2026-25263 | 2026-10-06 | 6.6 Medium | ||
| Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters. | ||||
| CVE-2026-105807 | 1 Sourcecodester | 1 Simple Student Information System | 2026-10-06 | 7.3 High |
| A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely. | ||||