Export limit exceeded: 361807 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (8716 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-41586 | 1 Hyperledger | 1 Fabric | 2026-05-07 | N/A |
| Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches. | ||||
| CVE-2023-6460 | 1 Google | 1 Cloud Firestore | 2026-05-07 | 4 Medium |
| A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue | ||||
| CVE-2025-36105 | 1 Ibm | 1 Planning Analytics Advanced Certified Containers | 2026-05-06 | 4.4 Medium |
| IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment variables. | ||||
| CVE-2026-41038 | 2 Qntmnet, Quantum Networks | 3 Qn-i-470, Qn-i-470 Firmware, Router Qn-i-470 | 2026-05-06 | 8.8 High |
| This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force attacks against user accounts, leading to unauthorized access to the targeted device. | ||||
| CVE-2026-22576 | 1 Fortinet | 3 Fortisoar, Fortisoaron-premise, Fortisoarpaas | 2026-05-06 | 4.1 Medium |
| A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration. | ||||
| CVE-2026-22574 | 1 Fortinet | 3 Fortisoar, Fortisoaron-premise, Fortisoarpaas | 2026-05-06 | 4.1 Medium |
| A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration. | ||||
| CVE-2026-32184 | 1 Microsoft | 2 Hpc Pack, Microsoft Hpc Pack 2019 | 2026-05-06 | 7.8 High |
| Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-42521 | 2 Jenkins, Jenkins Project | 2 Matrix Authorization Strategy, Jenkins Matrix Authorization Strategy Plugin | 2026-05-06 | 6.5 Medium |
| Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath. | ||||
| CVE-2014-125112 | 1 Miyagawa | 2 Plack::middleware::session::cookie, Plack\ | 2026-05-06 | 9.8 Critical |
| Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie. | ||||
| CVE-2026-23927 | 1 Zabbix | 1 Zabbix | 2026-05-06 | N/A |
| A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session. | ||||
| CVE-2023-54346 | 2 Backupbliss, Wordpress | 2 Wordpress Plugin Backup Migration, Wordpress | 2026-05-06 | 7.5 High |
| WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps. | ||||
| CVE-2026-7824 | 1 Papercut | 1 Papercut Hive | 2026-05-06 | N/A |
| An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files. An attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and subsequently retrieve sensitive device passwords from the logs after an authorized user authenticates at the device. This exposure allows for the lateral movement or unauthorized configuration of the physical print hardware. | ||||
| CVE-2026-6408 | 1 Tanium | 2 Server, Tanium Server | 2026-05-05 | 2.7 Low |
| Tanium addressed an information disclosure vulnerability in Tanium Server. | ||||
| CVE-2026-6023 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-05-05 | 8.1 High |
| In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible. | ||||
| CVE-2026-26210 | 1 Kvcache-ai | 1 Ktransformers | 2026-05-05 | 9.8 Critical |
| KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process. | ||||
| CVE-2026-7832 | 1 Iobit | 1 Advanced Systemcare | 2026-05-05 | 7 High |
| A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following. Attacking locally is a requirement. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-33819 | 1 Microsoft | 1 Bing | 2026-05-05 | 10 Critical |
| Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-27105 | 1 Dell | 2 Alienware Purchased Apps, Dell\/alienware Purchased Apps | 2026-05-05 | 6.3 Medium |
| Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write | ||||
| CVE-2026-7712 | 1 Mindsdb | 1 Mindsdb | 2026-05-05 | 6.3 Medium |
| A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-41882 | 1 Jetbrains | 1 Intellij Idea | 2026-05-05 | 7.4 High |
| In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server | ||||