Filtered by vendor Subscriptions
Total 401194 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-43839 2026-10-20 N/A
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
CVE-2026-112956 2026-10-20 6.5 Medium
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.
CVE-2026-113703 1 Giuseppe99barchetta 1 Suggestarr 2026-10-20 9.3 Critical
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
CVE-2026-100225 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-20 7 High
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-102186 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-20 4.7 Medium
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
CVE-2026-112955 2026-10-20 6.5 Medium
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
CVE-2026-43857 1 Advantech 1 Adam-3600 2026-10-20 N/A
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
CVE-2026-112954 2026-10-20 5.3 Medium
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
CVE-2026-43858 1 Advantech 1 Adam-3600 2026-10-20 N/A
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
CVE-2026-112953 2026-10-20 N/A
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.
CVE-2026-43840 2026-10-20 N/A
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
CVE-2026-43841 2026-10-20 N/A
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
CVE-2026-43843 2026-10-20 N/A
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
CVE-2026-43845 2026-10-20 N/A
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
CVE-2026-34485 2026-10-20 N/A
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.
CVE-2026-113401 2026-10-20 6.5 Medium
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
CVE-2026-111090 1 Stormshield 1 Stormshield Network Security 2026-10-20 7.8 High
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
CVE-2026-43847 1 Advantech 1 Adam-3600 2026-10-20 N/A
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
CVE-2026-43848 1 Advantech 1 Adam-3600 2026-10-20 N/A
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
CVE-2026-43849 1 Advantech 1 Adam-3600 2026-10-20 N/A
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.