Export limit exceeded: 346123 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (346123 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-40449 | 1 Samsung Open Source | 1 One | 2026-04-22 | 6.6 Medium |
| Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE. Affected version is prior to commit 1.30.0. | ||||
| CVE-2026-22754 | 1 Spring | 1 Spring Security | 2026-04-22 | 7.5 High |
| Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4. | ||||
| CVE-2026-33257 | 1 Powerdns | 3 Authoritative, Dnsdist, Recursor | 2026-04-22 | 5.3 Medium |
| An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default. | ||||
| CVE-2026-6392 | 1 Tanium | 1 Threat Response | 2026-04-22 | 2.7 Low |
| Tanium addressed an information disclosure vulnerability in Threat Response. | ||||
| CVE-2026-6408 | 1 Tanium | 1 Tanium Server | 2026-04-22 | 2.7 Low |
| Tanium addressed an information disclosure vulnerability in Tanium Server. | ||||
| CVE-2026-6416 | 1 Tanium | 2 Interact, Service Interact | 2026-04-22 | 2.7 Low |
| Tanium addressed an uncontrolled resource consumption vulnerability in Interact. | ||||
| CVE-2026-6842 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-04-22 | 2.5 Low |
| A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed. | ||||
| CVE-2026-0539 | 2026-04-22 | N/A | ||
| Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the service binary with arbitrary contents. This service binary is automatically launched with NT\SYSTEM privileges on boot. This issue affects all versions after 22.6.22.1329 and was fixed in 25.12.3.1745. | ||||
| CVE-2026-33610 | 1 Powerdns | 1 Authoritative | 2026-04-22 | 5.9 Medium |
| A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it. | ||||
| CVE-2026-33593 | 1 Powerdns | 1 Dnsdist | 2026-04-22 | 7.5 High |
| A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query. | ||||
| CVE-2026-33597 | 1 Powerdns | 1 Dnsdist | 2026-04-22 | 3.7 Low |
| PRSD detection denial of service | ||||
| CVE-2026-33598 | 1 Powerdns | 1 Dnsdist | 2026-04-22 | 4.8 Medium |
| A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache. | ||||
| CVE-2026-35367 | 2026-04-22 | 3.3 Low | ||
| The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions. | ||||
| CVE-2026-35369 | 2026-04-22 | 5.5 Medium | ||
| An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument. | ||||
| CVE-2026-33600 | 1 Powerdns | 1 Recursor | 2026-04-22 | 4.4 Medium |
| An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. | ||||
| CVE-2026-5921 | 1 Github | 1 Enterprise Server | 2026-04-22 | N/A |
| A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. When private mode was disabled, the notebook viewer followed HTTP redirects without revalidating the destination host, enabling an unauthenticated SSRF to internal services. By chaining this with regex filter queries against an internal API and measuring response time differences, an attacker could infer secret values character by character. Exploitation required that private mode be disabled and that the attacker be able to chain the instance's open redirect endpoint through an external redirect to reach internal services. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2026-41665 | 1 Samsung Open Source | 1 One | 2026-04-22 | 6.1 Medium |
| Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors. Affected version is prior to commit 1.30.0. | ||||
| CVE-2026-41667 | 1 Samsung Open Source | 1 One | 2026-04-22 | 6.6 Medium |
| Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0. | ||||
| CVE-2026-35379 | 2026-04-22 | 3.3 Low | ||
| A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing. | ||||
| CVE-2026-40542 | 1 Apache | 1 Httpclient | 2026-04-22 | 7.3 High |
| Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue. | ||||