Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425948 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-129456 | 1 Frrouting | 1 Frrouting | 2026-11-15 | N/A |
| In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute (type 23) while routes stored by bgpd still point to it, if the attribute is received from a neighbor that has "soft-reconfiguration inbound" configured. A cache added to speed up attribute interning while processing the prefixes of an UPDATE checks whether an interned attribute set may be reused by comparing the parsed attributes with themselves, so the check always succeeds. Interning the parsed attributes for the Adj-RIB-In removes the Tunnel Encapsulation sub-TLVs from them, and the copy that bgpd then interns for the route reuses the cached attribute set, which still holds the sub-TLVs, without taking a reference on them. When the route is later replaced, withdrawn or cleared, for example when the session goes down, the sub-TLV chain is freed while still in use, and bgpd then reads it, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required, and the attribute does not need to be malformed. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. Neighbors without "soft-reconfiguration inbound" are not affected. | ||||
| CVE-2026-73186 | 2 Shortpixel, Wordpress-extensions | 2 Enable Media Replace, Enable Media Replace | 2026-11-15 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Object Injection.This issue affects Enable Media Replace: from n/a through 4.2.2. | ||||
| CVE-2026-57739 | 2 Acymailing Newsletter Team, Wordpress | 2 Acymailing Smtp Newsletter, Wordpress | 2026-11-15 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through 10.11.0. | ||||
| CVE-2025-71470 | 1 Bellard | 1 Mquickjs | 2026-11-15 | 5.5 Medium |
| MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service. | ||||
| CVE-2026-125795 | 2 Estatik, Wordpress-extensions | 2 Estatik, Estatik | 2026-11-15 | 9.8 Critical |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6. | ||||
| CVE-2026-129485 | 1 Yuzutech | 1 Kroki | 2026-11-15 | 5.8 Medium |
| Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server. | ||||
| CVE-2026-129484 | 1 Yuzutech | 1 Kroki | 2026-11-15 | 6.1 Medium |
| Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it. | ||||
| CVE-2026-125771 | 2 Atlasaidev, Wordpress-extensions | 2 Mcp Server For Wordpress, Mcp Server For Wordpress | 2026-11-15 | 7.2 High |
| Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.3. | ||||
| CVE-2026-125857 | 2 Sarah Giles, Wordpress-extensions | 2 Dynamic User Directory, Dynamic User Directory | 2026-11-15 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through 2.4. | ||||
| CVE-2026-125443 | 2 Denishua, Wordpress-extensions | 2 Wpjam Basic, Wpjam Basic | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a through 7.1.2. | ||||
| CVE-2026-125832 | 2 Passionate Programmer Peter, Wordpress-extensions | 2 Wp Data Access, Wp Data Access | 2026-11-15 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows SQL Injection.This issue affects WP Data Access: from n/a through 5.5.92. | ||||
| CVE-2026-125828 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Bookit, Bookit | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP BookIt bookit allows Stored XSS.This issue affects BookIt: from n/a through 2.6.0.7. | ||||
| CVE-2025-71466 | 1 Gpac | 1 Gpac | 2026-11-15 | 5.5 Medium |
| GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service. | ||||
| CVE-2025-71467 | 1 Gpac | 1 Gpac | 2026-11-15 | 5.5 Medium |
| GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service. | ||||
| CVE-2025-71468 | 1 Gpac | 1 Gpac | 2026-11-15 | 5.5 Medium |
| GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service. | ||||
| CVE-2025-71469 | 1 Gpac | 1 Gpac | 2026-11-15 | 5.5 Medium |
| GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service. | ||||
| CVE-2026-129490 | 2026-11-15 | 5.5 Medium | ||
| littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that treats a stack lfs_diskoff struct as an lfs_attr array. Attackers can supply a crafted littlefs v1 image whose metadata is read as LFS_FROM_USERATTRS during migration, causing out-of-bounds stack reads and process crashes. | ||||
| CVE-2026-124259 | 2 Franky, Wordpress-extensions | 2 Events Made Easy, Events Made Easy | 2026-11-15 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events Made Easy events-made-easy allows Reflected XSS.This issue affects Events Made Easy: from n/a through 3.3.5. | ||||
| CVE-2026-125769 | 2 Nasirahmed, Wordpress-extensions | 2 Advanced Form Integration, Advanced Form Integration | 2026-11-15 | 9.8 Critical |
| Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a through 2.11.3. | ||||
| CVE-2026-129468 | 1 Netcccyun | 1 Dnsmgr | 2026-11-15 | 4.3 Medium |
| Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain's DNS line list and default line. | ||||