Export limit exceeded: 409447 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409447 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19621 | 2026-10-16 | 6.5 Medium | ||
| Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766 | ||||
| CVE-2026-19600 | 2026-10-16 | 4.5 Medium | ||
| Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763 | ||||
| CVE-2026-88132 | 1 Microsoft | 4 Azure Keyvault Administration, Azure Keyvault Certificates, Azure Keyvault Keys and 1 more | 2026-10-16 | 5.9 Medium |
| Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-70213 | 1 Microsoft | 2 Power-apps, Power Apps For Android | 2026-10-16 | 8 High |
| Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-12542 | 2 Redhat, Theforeman | 5 Enterprise Linux, Satellite, Satellite Capsule and 2 more | 2026-10-16 | 5.3 Medium |
| A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands. | ||||
| CVE-2026-64610 | 2026-10-16 | N/A | ||
| Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-63619 | 2026-10-16 | N/A | ||
| Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-63618 | 2026-10-16 | N/A | ||
| Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-108798 | 1 Zkteco | 1 Biotime | 2026-10-16 | 7.3 High |
| A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component. | ||||
| CVE-2026-108794 | 1 Zkteco | 1 Biotime | 2026-10-16 | 6.3 Medium |
| A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised. | ||||
| CVE-2026-97767 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-16 | 8.8 High |
| Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108129 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-16 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-106632 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-107305 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-109415 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-110037 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-110073 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-110074 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-110075 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-110077 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||