Export limit exceeded: 396677 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396677 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-11716 | 1 Ibm | 1 Mq For Hpe Nonstop | 2026-09-19 | 7.5 High |
| IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data. | ||||
| CVE-2026-11711 | 1 Ibm | 1 Websphere Application Server | 2026-09-19 | 6.5 Medium |
| IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component. | ||||
| CVE-2026-11710 | 1 Ibm | 1 Websphere Application Server | 2026-09-19 | 6.5 Medium |
| IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers. | ||||
| CVE-2026-11548 | 1 Ibm | 1 Cics Tx Advanced | 2026-09-19 | 4.8 Medium |
| IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-11545 | 1 Ibm | 1 Websphere Application Server | 2026-09-19 | 3.7 Low |
| IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks. | ||||
| CVE-2026-11540 | 1 Ibm | 1 Websphere Application Server | 2026-09-19 | 5.3 Medium |
| IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet. | ||||
| CVE-2026-11539 | 1 Ibm | 1 Websphere Application Server | 2026-09-19 | 5.3 Medium |
| IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector. | ||||
| CVE-2026-88097 | 1 Microsoft | 1 Edge Chromium | 2026-09-19 | 8.1 High |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-84241 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 8.1 High |
| IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization. | ||||
| CVE-2026-84239 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 7.6 High |
| IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-84108 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 8.1 High |
| IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation. | ||||
| CVE-2026-84105 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 7.7 High |
| IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-84089 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 7.8 High |
| IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management. | ||||
| CVE-2026-84086 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 7.2 High |
| IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-84085 | 1 Ibm | 1 Guardium Data Protection | 2026-09-19 | 8.1 High |
| IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-93056 | 1 Linux | 1 Linux Kernel | 2026-09-19 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: remove broken string configfs attributes The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value. This means every write attempt returns -ENOMEM on success and dereferences a NULL pointer on allocation failure. The attributes have been broken and unused for many years. Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE, FILE_CONTROL) set in f_audio_alloc_inst() are unaffected. | ||||
| CVE-2026-92524 | 1 Linux | 1 Linux Kernel | 2026-09-19 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() When its_irq_gic_domain_alloc() fails, the following its_vpe_irq_domain_free() fails to invoke its_vep_teardown() for the corresponding interrupt, which leaks the resource. Invoke its_vpe_teardown() in the error handling path to avoid the leak. [ tglx: Massaged change log ] | ||||
| CVE-2026-92802 | 2 Kan, Kanbn | 2 Kan, Kan | 2026-09-19 | 4.3 Medium |
| kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths. | ||||
| CVE-2026-93450 | 1 Go-openapi | 1 Swag | 2026-09-19 | 7.5 High |
| go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests. | ||||
| CVE-2026-90386 | 1 Linux | 1 Linux Kernel | 2026-09-19 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count of addresses left unassigned) equals master->maxdevs. The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server: UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy) Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master] i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c] Skip the mask when no new device was assigned. | ||||