Export limit exceeded: 387307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 387307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (387307 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86175 | 2 Netbox, Netbox-community | 2 Netbox, Netbox | 2026-09-07 | 6.5 Medium |
| NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets. | ||||
| CVE-2026-86176 | 2 Netbox, Netbox-community | 2 Netbox, Netbox | 2026-09-07 | 4.3 Medium |
| NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects. | ||||
| CVE-2025-15614 | 1 Genivia | 1 Ugrep | 2026-09-07 | 3.3 Low |
| ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process. | ||||
| CVE-2025-15647 | 1 Artem-ogre | 1 Cdt | 2026-09-07 | 5.5 Medium |
| CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data to trigger an out-of-bounds array access that crashes the calling process. | ||||
| CVE-2026-86185 | 1 Bilibili | 1 Bilibili Desktop | 2026-09-07 | 8 High |
| Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials. | ||||
| CVE-2026-0799 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 8.7 High |
| In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures. | ||||
| CVE-2026-31912 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 5.5 Medium |
| libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures. | ||||
| CVE-2026-31911 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 5.5 Medium |
| libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process. | ||||
| CVE-2026-6244 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 5.5 Medium |
| libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero. | ||||
| CVE-2026-6554 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 5.5 Medium |
| libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely. | ||||
| CVE-2026-18313 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 4.3 Medium |
| rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster. | ||||
| CVE-2026-18238 | 1 Tcpdump | 1 Libpcap | 2026-09-07 | 5 Medium |
| The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet. | ||||
| CVE-2020-37277 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-07 | 6.5 Medium |
| PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server. | ||||
| CVE-2021-48006 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-07 | 3.3 Low |
| PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually. | ||||
| CVE-2021-48007 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-07 | 6.5 Medium |
| PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players. | ||||
| CVE-2022-51008 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-07 | 5.3 Medium |
| PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining. | ||||
| CVE-2022-51009 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-07 | 7.5 High |
| PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash. | ||||
| CVE-2026-86258 | 1 Jupyter | 1 Nbviewer | 2026-09-07 | 5.9 Medium |
| nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials. | ||||
| CVE-2026-86259 | 1 Thu-maic | 1 Openmaic | 2026-09-07 | 7.5 High |
| OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata. | ||||
| CVE-2026-86219 | 1 Perl | 1 Authen::sasl::perl::digest Md5 | 2026-09-07 | N/A |
| Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password. | ||||