Export limit exceeded: 389596 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 389596 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389596 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17443 | 1 Ibm | 3 App Connect Enterprise, Integration Bus For Z\/os, Integration Bus For Zos | 2026-09-09 | 5.3 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. | ||||
| CVE-2026-17444 | 1 Ibm | 3 App Connect Enterprise, Integration Bus For Z\/os, Integration Bus For Zos | 2026-09-09 | 5.3 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection. | ||||
| CVE-2026-47156 | 2026-09-09 | N/A | ||
| MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API. The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed. The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client. Version 2.28.4 contains a patch. No known workarounds are available. | ||||
| CVE-2026-18649 | 1 Redhat | 4 Enterprise Linux, Enterprise Linux Eus, Rhel E4s and 1 more | 2026-09-09 | 7.5 High |
| A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination. | ||||
| CVE-2026-14164 | 3 Libarchive, Red Hat, Redhat | 12 Libarchive, Enterprise Linux, Discovery and 9 more | 2026-09-09 | 7.5 High |
| A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service. | ||||
| CVE-2026-56125 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49947 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-43645 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-43635 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-34412 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-28523 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-26350 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-24442 | 2026-09-09 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-17469 | 1 Ibm | 1 I | 2026-09-09 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser. | ||||
| CVE-2026-77104 | 3 Commvault, Linux, Microsoft | 3 Commvault, Linux Kernel, Windows | 2026-09-09 | 7.5 High |
| CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | ||||
| CVE-2026-77103 | 3 Commvault, Linux, Microsoft | 3 Commvault, Linux Kernel, Windows | 2026-09-09 | 7.5 High |
| CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | ||||
| CVE-2026-77102 | 3 Commvault, Linux, Microsoft | 3 Commvault, Linux Kernel, Windows | 2026-09-09 | 7.5 High |
| CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe. | ||||
| CVE-2026-77101 | 3 Commvault, Linux, Microsoft | 3 Commvault, Linux Kernel, Windows | 2026-09-09 | 7.5 High |
| CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe. | ||||
| CVE-2026-13739 | 1 Commvault | 1 Commvault | 2026-09-09 | 9.8 Critical |
| A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center. | ||||
| CVE-2026-13737 | 1 Commvault | 1 Commvault | 2026-09-09 | 9.8 Critical |
| CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X. | ||||