Export limit exceeded: 414633 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414633 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95708 | 1 Hpe | 1 Aos | 2026-10-26 | 7.2 High |
| Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-95709 | 1 Hpe | 1 Aos | 2026-10-26 | 7.2 High |
| Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-95711 | 1 Hpe | 1 Aos | 2026-10-26 | 7.1 High |
| An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system. | ||||
| CVE-2026-95713 | 1 Hpe | 1 Aos | 2026-10-26 | 7 High |
| An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data. | ||||
| CVE-2026-95714 | 1 Hpe | 1 Aos | 2026-10-26 | 6.8 Medium |
| A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. | ||||
| CVE-2026-95715 | 1 Hpe | 1 Aos | 2026-10-26 | 6.8 Medium |
| An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise. | ||||
| CVE-2026-95716 | 1 Hpe | 1 Aos | 2026-10-26 | 6.5 Medium |
| An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system. | ||||
| CVE-2026-95717 | 1 Hpe | 1 Aos | 2026-10-26 | 5.5 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session. | ||||
| CVE-2026-95718 | 1 Hpe | 1 Aos | 2026-10-26 | 5.3 Medium |
| An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system. | ||||
| CVE-2026-95719 | 1 Hpe | 1 Aos | 2026-10-26 | 4.9 Medium |
| An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting normal operation of the affected device. | ||||
| CVE-2026-95720 | 1 Hpe | 1 Aos | 2026-10-26 | 4.4 Medium |
| A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations. | ||||
| CVE-2026-95721 | 1 Hpe | 1 Aos | 2026-10-26 | 3.3 Low |
| A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service. | ||||
| CVE-2026-112330 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single double-quote header value, or an unparsable typed attribute such as cloudEvents:time to trigger an unhandled exception in ExtractCloudEvent that is treated as fatal, causing the application to stop and the unacknowledged message to be redelivered on restart, resulting in a permanent crash-loop. | ||||
| CVE-2026-112331 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop. | ||||
| CVE-2026-112332 | 1 Gdatasoftwareag | 1 Motornet | 2026-10-26 | 7.5 High |
| Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's expected type. Attackers can exploit the fact that JsonSerializationException is not caught alongside JsonReaderException and InvalidCastException, causing TypedConsumerService.SingleMessageConsumeAsync to treat the error as CriticalFailure and call StopApplication, which combined with the unacknowledged message being redelivered on restart results in a permanent crash-loop. | ||||
| CVE-2026-111594 | 1 Intersystems | 1 Iris For Health | 2026-10-26 | 8.1 High |
| InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | ||||
| CVE-2026-55981 | 1 Creative Labs | 1 Creative Sound Blaster Katana | 2026-10-26 | 9.6 Critical |
| A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. | ||||
| CVE-2026-63243 | 1 Creative Labs | 1 Creative Sound Blaster Katana | 2026-10-26 | 4.3 Medium |
| An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication. | ||||
| CVE-2026-63244 | 1 Wizlearn Technologies | 1 Learning Management System | 2026-10-26 | 9.8 Critical |
| An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform. | ||||
| CVE-2026-4950 | 1 Vertigis | 1 Webordersystem | 2026-10-26 | N/A |
| The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions. | ||||