Export limit exceeded: 402914 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (402914 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103507 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account. | ||||
| CVE-2026-104811 | 1 Mitel | 1 Mivoice Office 400 | 2026-10-06 | N/A |
| DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system. | ||||
| CVE-2026-103512 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner. | ||||
| CVE-2026-103511 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory. | ||||
| CVE-2026-103510 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server. | ||||
| CVE-2026-63277 | 1 The Document Foundation | 1 Libreoffice | 2026-10-06 | 7.8 High |
| LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL. | ||||
| CVE-2026-63266 | 1 The Document Foundation | 1 Libreoffice | 2026-10-06 | 5.5 Medium |
| LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory. | ||||
| CVE-2026-63268 | 1 The Document Foundation | 1 Libreoffice | 2026-10-06 | 5.5 Medium |
| LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded. | ||||
| CVE-2026-63269 | 1 The Document Foundation | 1 Libreoffice | 2026-10-06 | 5.5 Medium |
| LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control. | ||||
| CVE-2026-63270 | 1 The Document Foundation | 1 Libreoffice | 2026-10-06 | 5.5 Medium |
| URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document. | ||||
| CVE-2026-102775 | 1 Phoca | 1 Phoca Cart Extension For Joomla | 2026-10-06 | N/A |
| Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens. | ||||
| CVE-2026-102426 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-10-06 | N/A |
| Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value. | ||||
| CVE-2026-105647 | 1 Ghost | 1 Ghost | 2026-10-06 | 4 Medium |
| Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0. | ||||
| CVE-2026-105648 | 1 Ghost | 1 Ghost | 2026-10-06 | 4 Medium |
| Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0. | ||||
| CVE-2026-105649 | 1 Ghost | 1 Ghost | 2026-10-06 | 7.3 High |
| Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0. | ||||
| CVE-2026-105650 | 1 Ghost | 1 Ghost | 2026-10-06 | 8.1 High |
| Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0. | ||||
| CVE-2026-105651 | 1 Ghost | 1 Ghost | 2026-10-06 | 7.3 High |
| Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0. | ||||
| CVE-2026-105652 | 1 Ghost | 1 Ghost | 2026-10-06 | 3.1 Low |
| Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0. | ||||
| CVE-2026-105675 | 1 Ghost | 1 Ghost | 2026-10-06 | 7.5 High |
| Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0. | ||||
| CVE-2026-105676 | 1 Ghost | 1 Ghost | 2026-10-06 | 4.9 Medium |
| Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0. | ||||