Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
94,612 matching · page 9/1893Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-79835(opens NVD record) | Low | 2.8 | A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server. | Oct 15, 2026 |
| CVE-2026-79834(opens NVD record) | High | 7.4 | A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution. | Oct 15, 2026 |
| CVE-2026-110726(opens NVD record) | Medium | 6.5 | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration. | Oct 15, 2026 |
| CVE-2026-79833(opens NVD record) | High | 7.5 | A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service. | Oct 15, 2026 |
| CVE-2026-79832(opens NVD record) | High | 7.6 | A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash. | Oct 15, 2026 |
| CVE-2026-79831(opens NVD record) | Medium | 6.6 | A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution. | Oct 15, 2026 |
| CVE-2026-79830(opens NVD record) | Medium | 6.6 | A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution. | Oct 15, 2026 |
| CVE-2026-17525(opens NVD record) | Medium | 5.2 | Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5. | Oct 15, 2026 |
| CVE-2026-109695(opens NVD record) | High | 7.5 | Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1. | Oct 15, 2026 |
| CVE-2026-109694(opens NVD record) | Critical | 9.8 | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. | Oct 15, 2026 |
| CVE-2026-108498(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1. | Oct 15, 2026 |
| CVE-2026-108497(opens NVD record) | Critical | 9.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10. | Oct 15, 2026 |
| CVE-2026-108491(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1. | Oct 15, 2026 |
| CVE-2026-79829(opens NVD record) | High | 8.2 | A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt. | Oct 15, 2026 |
| CVE-2026-79828(opens NVD record) | High | 7.1 | A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow. | Oct 15, 2026 |
| CVE-2026-79827(opens NVD record) | High | 7.1 | A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow. | Oct 15, 2026 |
| CVE-2026-79826(opens NVD record) | High | 7.1 | A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. | Oct 15, 2026 |
| CVE-2026-79825(opens NVD record) | High | 7.1 | A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. | Oct 15, 2026 |
| CVE-2026-79824(opens NVD record) | High | 8.0 | A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive. | Oct 15, 2026 |
| CVE-2026-53882(opens NVD record) | Unscored | — | An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later | Oct 15, 2026 |
| CVE-2026-50619(opens NVD record) | Unscored | — | A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later | Oct 15, 2026 |
| CVE-2026-50612(opens NVD record) | Unscored | — | An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later | Oct 15, 2026 |
| CVE-2026-47790(opens NVD record) | Unscored | — | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later | Oct 15, 2026 |
| CVE-2026-47786(opens NVD record) | Unscored | — | An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later | Oct 15, 2026 |
| CVE-2026-44084(opens NVD record) | Unscored | — | An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | Oct 15, 2026 |
| CVE-2026-41545(opens NVD record) | Unscored | — | A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later | Oct 15, 2026 |
| CVE-2026-41541(opens NVD record) | Unscored | — | An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later | Oct 15, 2026 |
| CVE-2026-39997(opens NVD record) | Unscored | — | A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later | Oct 15, 2026 |
| CVE-2026-39991(opens NVD record) | Unscored | — | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later | Oct 15, 2026 |
| CVE-2026-39989(opens NVD record) | Unscored | — | A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later | Oct 15, 2026 |
| CVE-2026-34015(opens NVD record) | Unscored | — | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | Oct 15, 2026 |
| CVE-2026-34014(opens NVD record) | Unscored | — | An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later | Oct 15, 2026 |
| CVE-2026-34009(opens NVD record) | Unscored | — | An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later | Oct 15, 2026 |
| CVE-2026-34008(opens NVD record) | Unscored | — | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later | Oct 15, 2026 |
| CVE-2026-34007(opens NVD record) | Unscored | — | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later | Oct 15, 2026 |
| CVE-2026-34006(opens NVD record) | Unscored | — | A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later | Oct 15, 2026 |
| CVE-2026-26245(opens NVD record) | Unscored | — | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | Oct 15, 2026 |
| CVE-2026-26244(opens NVD record) | Unscored | — | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | Oct 15, 2026 |
| CVE-2026-26243(opens NVD record) | Unscored | — | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later | Oct 15, 2026 |
| CVE-2026-19864(opens NVD record) | Unscored | — | Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users. | Oct 15, 2026 |
| CVE-2026-19863(opens NVD record) | Unscored | — | An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected. | Oct 15, 2026 |
| CVE-2026-18662(opens NVD record) | Unscored | — | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set. | Oct 15, 2026 |
| CVE-2026-18660(opens NVD record) | Unscored | — | In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case. | Oct 15, 2026 |
| CVE-2026-18659(opens NVD record) | Unscored | — | In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods. | Oct 15, 2026 |
| CVE-2026-96614(opens NVD record) | Medium | 5.4 | "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID. | Oct 15, 2026 |
| CVE-2026-79823(opens NVD record) | Medium | 4.0 | HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior. | Oct 15, 2026 |
| CVE-2026-77711(opens NVD record) | Unscored | — | When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials. | Oct 15, 2026 |
| CVE-2026-76184(opens NVD record) | Unscored | — | In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target. | Oct 15, 2026 |
| CVE-2026-76182(opens NVD record) | Unscored | — | In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`. | Oct 15, 2026 |
| CVE-2026-75559(opens NVD record) | Medium | 5.3 | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key. | Oct 15, 2026 |