Export limit exceeded: 420575 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420575 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97027 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 3.6 Low |
| Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit. | ||||
| CVE-2026-97026 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 3.9 Low |
| Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted. | ||||
| CVE-2026-97025 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 3.2 Low |
| Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not. | ||||
| CVE-2026-96546 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-06 | 2.5 Low |
| A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated. | ||||
| CVE-2026-96284 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 2.5 Low |
| A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control. | ||||
| CVE-2026-96283 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 3.3 Low |
| By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped. | ||||
| CVE-2026-96282 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 3.1 Low |
| A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox. | ||||
| CVE-2026-101595 | 1 Oracle | 1 Agile Product Lifecycle Management For Process | 2026-11-06 | 5.4 Medium |
| Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supply Chain Relationship Mgmt). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). | ||||
| CVE-2026-101599 | 1 Oracle | 1 Vm Virtualbox | 2026-11-06 | 7.5 High |
| Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). | ||||
| CVE-2026-123012 | 1 Gogs | 1 Gogs | 2026-11-06 | N/A |
| In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of a case-sensitivity desync between the authorization classifier and the request dispatcher: the gitHTTPIsPull function compares the Git action verb case-sensitively and defaults to pull (read access) for any unrecognized string, whereas the request dispatcher lowercases the same verb before routing it to the receive-pack handler. Capitalizing a single letter in the URL (e.g. info/Refs instead of info/refs, or git-receive-Pack instead of git-receive-pack) causes the classifier to misidentify a push as a pull, granting only read-level authorization, whereas the dispatcher routes it to the write handler. An authenticated read-only collaborator can exploit this to push to a private repository, creating, updating, or deleting refs. | ||||
| CVE-2026-119170 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-06 | N/A |
| There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected. | ||||
| CVE-2026-84473 | 1 Kiteworks | 1 Owncloud | 2026-11-06 | N/A |
| Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint. | ||||
| CVE-2026-123846 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 4.3 Medium |
| In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation | ||||
| CVE-2026-123854 | 1 Jetbrains | 1 Pycharm | 2026-11-06 | 5.5 Medium |
| In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module | ||||
| CVE-2026-106142 | 1 Progress | 1 Kendoreact | 2026-11-06 | 5.4 Medium |
| Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link. | ||||
| CVE-2026-106127 | 1 Progress | 1 Kendoreact | 2026-11-06 | 4.1 Medium |
| Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability. | ||||
| CVE-2026-93009 | 3 Dnsmasq, Red Hat, Redhat | 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more | 2026-11-06 | 4.3 Medium |
| A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated. | ||||
| CVE-2026-93010 | 3 Dnsmasq, Red Hat, Redhat | 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more | 2026-11-06 | 4.3 Medium |
| A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on. | ||||
| CVE-2026-91926 | 1 Redhat | 1 Enterprise Linux | 2026-11-06 | 3.7 Low |
| A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service. | ||||
| CVE-2026-91142 | 1 Redhat | 4 Enterprise Linux, Openshift Dev Spaces, Openshift Devspaces and 1 more | 2026-11-06 | 3.6 Low |
| A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts. | ||||