Export limit exceeded: 402737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 402737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (402737 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79797 | 1 Hewlett Packard Enterprise (hpe) | 1 Clearpass Policy Manager (cppm) | 2026-10-07 | 8.8 High |
| An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to obtain sensitive information from the affected user. | ||||
| CVE-2026-96404 | 1 Gitea | 1 Gitea | 2026-10-07 | N/A |
| When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation. | ||||
| CVE-2026-96589 | 1 Gitea | 1 Gitea | 2026-10-07 | N/A |
| When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved. | ||||
| CVE-2026-106552 | 1 Openbsd | 1 Openssh | 2026-10-07 | 4.2 Medium |
| In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation. | ||||
| CVE-2026-106460 | 2026-10-07 | 6.8 Medium | ||
| Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5. | ||||
| CVE-2026-106492 | 2026-10-07 | 7.6 High | ||
| Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8. | ||||
| CVE-2026-106585 | 1 Openbsd | 1 Openssh | 2026-10-07 | 6.5 Medium |
| In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. | ||||
| CVE-2026-106586 | 1 Openbsd | 1 Openssh | 2026-10-07 | 2.5 Low |
| In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283. | ||||
| CVE-2026-65142 | 2026-10-07 | 7.8 High | ||
| NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure. | ||||
| CVE-2026-106588 | 1 Openbsd | 1 Openssh | 2026-10-07 | 3.1 Low |
| In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. | ||||
| CVE-2026-70357 | 1 Gitea | 1 Gitea | 2026-10-07 | N/A |
| Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess. | ||||
| CVE-2026-73278 | 1 Gitea | 1 Gitea | 2026-10-07 | N/A |
| Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario. | ||||
| CVE-2026-88962 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | ||||
| CVE-2026-93443 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code. | ||||
| CVE-2026-93448 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-93449 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 8.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | ||||
| CVE-2026-93445 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. | ||||
| CVE-2026-93447 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process. | ||||
| CVE-2026-93675 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | ||||
| CVE-2026-93677 | 1 Ibm | 1 Langflow Oss | 2026-10-07 | 7.7 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor. | ||||