Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
66,064 matching · page 2/1322Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-111320(opens NVD record) | Medium | 6.5 | ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys. | Oct 15, 2026 |
| CVE-2026-111313(opens NVD record) | Medium | 6.5 | JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data. | Oct 15, 2026 |
| CVE-2026-111312(opens NVD record) | High | 7.7 | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it. | Oct 15, 2026 |
| CVE-2026-111284(opens NVD record) | Medium | 5.4 | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions. | Oct 15, 2026 |
| CVE-2026-111283(opens NVD record) | Critical | 9.0 | BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records. | Oct 15, 2026 |
| CVE-2026-111282(opens NVD record) | High | 8.2 | Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory. | Oct 15, 2026 |
| CVE-2026-111281(opens NVD record) | Critical | 9.8 | Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control. | Oct 15, 2026 |
| CVE-2026-111280(opens NVD record) | High | 7.4 | snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory. | Oct 15, 2026 |
| CVE-2026-111279(opens NVD record) | High | 7.5 | Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients. | Oct 15, 2026 |
| CVE-2026-111278(opens NVD record) | Medium | 5.3 | NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests. | Oct 15, 2026 |
| CVE-2026-111277(opens NVD record) | High | 7.5 | NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals. | Oct 15, 2026 |
| CVE-2026-111275(opens NVD record) | Medium | 6.1 | nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory. | Oct 15, 2026 |
| CVE-2026-111274(opens NVD record) | Medium | 5.5 | unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process. | Oct 15, 2026 |
| CVE-2026-111273(opens NVD record) | Medium | 6.1 | unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process. | Oct 15, 2026 |
| CVE-2026-111272(opens NVD record) | Medium | 5.5 | LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image. | Oct 15, 2026 |
| CVE-2026-111271(opens NVD record) | Medium | 5.5 | libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer. | Oct 15, 2026 |
| CVE-2026-111270(opens NVD record) | Medium | 6.1 | libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process. | Oct 15, 2026 |
| CVE-2026-111269(opens NVD record) | Medium | 6.1 | libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory. | Oct 15, 2026 |
| CVE-2026-110922(opens NVD record) | Unscored | — | Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 15, 2026 |
| CVE-2026-110921(opens NVD record) | Unscored | — | Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110920(opens NVD record) | Unscored | — | Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110919(opens NVD record) | Unscored | — | Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110918(opens NVD record) | Unscored | — | Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110917(opens NVD record) | Unscored | — | Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2026-110916(opens NVD record) | Unscored | — | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 15, 2026 |
| CVE-2026-110915(opens NVD record) | Unscored | — | Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 15, 2026 |
| CVE-2026-110914(opens NVD record) | Unscored | — | Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 15, 2026 |
| CVE-2026-110913(opens NVD record) | Unscored | — | Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 15, 2026 |
| CVE-2024-58397(opens NVD record) | Medium | 6.1 | MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles. | Oct 15, 2026 |
| CVE-2026-111357(opens NVD record) | High | 7.0 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. | Oct 15, 2026 |
| CVE-2026-109468(opens NVD record) | High | 7.5 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Oct 15, 2026 |
| CVE-2026-108455(opens NVD record) | Medium | 6.5 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Oct 15, 2026 |
| CVE-2026-108454(opens NVD record) | Medium | 6.5 | Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Oct 15, 2026 |
| CVE-2026-108453(opens NVD record) | Medium | 6.5 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Oct 15, 2026 |
| CVE-2026-108452(opens NVD record) | High | 8.8 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108451(opens NVD record) | High | 8.8 | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108450(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108449(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108448(opens NVD record) | High | 7.5 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108447(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108446(opens NVD record) | High | 8.8 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108445(opens NVD record) | High | 8.8 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108444(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108443(opens NVD record) | High | 8.8 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108442(opens NVD record) | High | 8.8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108441(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108440(opens NVD record) | High | 8.8 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108439(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |
| CVE-2026-108438(opens NVD record) | Medium | 6.5 | Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Oct 15, 2026 |
| CVE-2026-108437(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Oct 15, 2026 |