Export limit exceeded: 423988 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423988 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423988 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423988 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-38808 | 1 Ghostxbh | 1 Uzy-ssm-mall | 2026-10-19 | 5.3 Medium |
| SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components | ||||
| CVE-2025-29897 | 1 Qnap Systems | 1 Qsync Central | 2026-10-19 | N/A |
| A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later | ||||
| CVE-2026-31239 | 1 State-spaces | 1 Mamba | 2026-10-19 | 9.8 Critical |
| The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from_pretrained() method uses torch.load() to load the pytorch_model.bin weight file without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by publishing a malicious model repository on HuggingFace Hub. When a victim loads a model from this repository, arbitrary code is executed on the victim's system in the context of the mamba process. | ||||
| CVE-2026-31237 | 1 Ludwig-ai | 1 Ludwig | 2026-10-19 | 9.8 Critical |
| The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method. When a user provides a dataset file path to the predict() method, the framework automatically determines the file format. If the file is a pickle (.pkl) file, it is loaded using pandas.read_pickle() without any validation or security restrictions. This allows the deserialization of arbitrary Python objects via the unsafe pickle module. A remote attacker can exploit this by providing a maliciously crafted pickle file, leading to arbitrary code execution on the system running the Ludwig prediction. | ||||
| CVE-2026-31234 | 1 Horovod | 1 Horovod | 2026-10-19 | 9.8 Critical |
| Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed task coordination, lacks authentication and authorization controls, allowing any remote attacker to write arbitrary data via HTTP PUT requests. When a Horovod worker reads data from the KVStore (via HTTP GET), it deserializes the data using cloudpickle.loads() without verifying its source or integrity. An attacker can exploit this by sending a malicious pickle payload to the server before the legitimate data is written, causing the victim worker to deserialize and execute arbitrary code, leading to remote code execution. | ||||
| CVE-2026-97841 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-111899 | 1 Tombursch | 1 Kitchenowl | 2026-10-19 | 4.3 Medium |
| KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services. | ||||
| CVE-2026-111061 | 1 Eugeny | 1 Russh | 2026-10-19 | 4.3 Medium |
| russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1. | ||||
| CVE-2026-112310 | 1 Docling | 1 Docling-core | 2026-10-19 | 4.3 Medium |
| docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence. | ||||
| CVE-2026-111937 | 1 Frappe | 2 Crm, Frappe Crm | 2026-10-19 | 5.4 Medium |
| Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications. | ||||
| CVE-2026-112282 | 1 Videolan | 1 Libbluray | 2026-10-19 | 5.5 Medium |
| VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service. | ||||
| CVE-2026-112363 | 2 Kidocode, Unclecode | 2 Crawl4ai, Crawl4ai | 2026-10-19 | 5.3 Medium |
| Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details. | ||||
| CVE-2026-97829 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-112285 | 1 Thelia | 1 Thelia | 2026-10-19 | 4.3 Medium |
| Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts. | ||||
| CVE-2026-112286 | 1 Krayin | 1 Laravel-crm | 2026-10-19 | 6.5 Medium |
| Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead. | ||||
| CVE-2026-111748 | 1 Aio-libs | 1 Aiohttp | 2026-10-19 | 6.5 Medium |
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4. | ||||
| CVE-2024-54657 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54656 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54655 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||
| CVE-2024-54654 | 2026-10-19 | N/A | ||
| This candidate was in a CNA pool that was not assigned to any issues. | ||||