Export limit exceeded: 237699 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237699 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (237699 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124007 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124006 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124005 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124004 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 9.8 Critical |
| XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124003 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 7.8 High |
| XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-118976 | 2026-11-13 | 7.5 High | ||
| In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope. | ||||
| CVE-2026-128910 | 2026-11-13 | 6.8 Medium | ||
| Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available. | ||||
| CVE-2026-128909 | 2026-11-13 | 8.8 High | ||
| Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available. | ||||
| CVE-2026-124993 | 1 Synology | 1 Diskstation Manager | 2026-11-13 | 5.3 Medium |
| An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files. | ||||
| CVE-2026-128908 | 2026-11-13 | 8.8 High | ||
| OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to execute arbitrary commands as root. Configuration values that can be written without authentication over the management interface are inserted unquoted into shell commands. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The injected command persists across reboots. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available. | ||||
| CVE-2026-128907 | 2026-11-13 | 4.3 Medium | ||
| Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to read device information, such as the serial number, MAC address, IP address and radio configuration, and to change configuration settings. The service accepts commands in DJI's proprietary DUML protocol without any authentication. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. The same commands are also accepted over the USB operator port. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available. | ||||
| CVE-2026-109094 | 1 X.org | 2 Xorg-x11-server, Xwayland | 2026-11-13 | N/A |
| A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 on 32bit systems could be used by authenticated clients to crash the X server. | ||||
| CVE-2026-109093 | 1 X.org | 2 Xorg-x11-server, Xwayland | 2026-11-13 | N/A |
| A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash or execute code in the X server. | ||||
| CVE-2026-124951 | 2026-11-13 | 8.8 High | ||
| Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124854 | 2026-11-13 | 8.8 High | ||
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-0175 | 1 Google | 1 Android | 2026-11-13 | 8.4 High |
| In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-100082 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-13 | 4.7 Medium |
| In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data. Use a rwlock for synchronizing. This is XSA-528 / CVE-2026-100082 | ||||
| CVE-2026-100081 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-13 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081. | ||||
| CVE-2026-100080 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-13 | 5.6 Medium |
| In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend (e.g. due to illegal Xenstore data filled in by the guest), the statistic data is being freed without synchronizing the RCU state. In case the data is being read via sysfs in this phase, access to already freed memory or memory being in new use is possible. Fix that by calling synchronize_net() before freeing the queue data. This is XSA-526 / CVE-2026-100080 | ||||
| CVE-2026-85091 | 1 Zlib | 1 Zlib | 2026-11-13 | 7.4 High |
| zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call. | ||||