Export limit exceeded: 419555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419555 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-6240 | 2 Linux, Redhat | 4 Linux Kernel, Enterprise Linux, Rhel Els and 1 more | 2026-11-05 | 6.5 Medium |
| A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key. | ||||
| CVE-2023-5992 | 2 Opensc Project, Redhat | 12 Opensc, Enterprise Linux, Enterprise Linux Eus and 9 more | 2026-11-05 | 5.6 Medium |
| A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. | ||||
| CVE-2023-5981 | 4 Debian, Fedoraproject, Gnu and 1 more | 9 Debian Linux, Fedora, Gnutls and 6 more | 2026-11-05 | 5.9 Medium |
| A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. | ||||
| CVE-2023-5871 | 1 Redhat | 3 Enterprise Linux, Libnbd, Rhel Els | 2026-11-05 | 5.3 Medium |
| A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service. | ||||
| CVE-2023-5868 | 2 Postgresql, Redhat | 23 Postgresql, Advanced Cluster Security, Codeready Linux Builder Eus and 20 more | 2026-11-05 | 4.3 Medium |
| A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory. | ||||
| CVE-2023-5764 | 2 Fedoraproject, Redhat | 9 Extra Packages For Enterprise Linux, Fedora, Ansible and 6 more | 2026-11-05 | 7.1 High |
| A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data. | ||||
| CVE-2023-5675 | 1 Redhat | 11 A Mq Clients, Camel K, Camel Quarkus and 8 more | 2026-11-05 | 6.5 Medium |
| A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties. | ||||
| CVE-2023-5455 | 3 Fedoraproject, Freeipa, Redhat | 26 Fedora, Freeipa, Codeready Linux Builder and 23 more | 2026-11-05 | 6.5 Medium |
| A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. | ||||
| CVE-2024-2700 | 1 Redhat | 10 Amq Streams, Apache Camel Hawtio, Apicurio Registry and 7 more | 2026-11-05 | 7 High |
| A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured. | ||||
| CVE-2026-116409 | 2026-11-05 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.7. | ||||
| CVE-2023-5380 | 4 Debian, Fedoraproject, Redhat and 1 more | 6 Debian Linux, Fedora, Enterprise Linux and 3 more | 2026-11-05 | 4.7 Medium |
| A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. | ||||
| CVE-2023-5379 | 1 Redhat | 11 Jboss Bpms, Jboss Data Grid, Jboss Enterprise Application Platform and 8 more | 2026-11-05 | 7.5 High |
| A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS). | ||||
| CVE-2026-103331 | 2026-11-05 | 5.3 Medium | ||
| The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid. | ||||
| CVE-2026-27541 | 2 Josh Kohlbach, Wordpress | 2 Wholesale Suite, Wordpress | 2026-11-05 | 7.2 High |
| Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affects Wholesale Suite: through 2.2.6. | ||||
| CVE-2026-27542 | 2 Rymera Web Co Pty Ltd., Wordpress | 2 Woocommerce Wholesale Lead Capture, Wordpress | 2026-11-05 | 9.8 Critical |
| Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1. | ||||
| CVE-2026-27540 | 2 Rymera Web Co Pty Ltd., Wordpress | 2 Woocommerce Wholesale Lead Capture, Wordpress | 2026-11-05 | 9 Critical |
| Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1. | ||||
| CVE-2026-117679 | 1 Shirasagi Project | 1 Shirasagi | 2026-11-05 | N/A |
| A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product. | ||||
| CVE-2026-118869 | 1 Shirasagi Project | 1 Shirasagi | 2026-11-05 | N/A |
| An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product. | ||||
| CVE-2026-123036 | 1 Redhat | 1 Ansible Core | 2026-11-05 | 5.5 Medium |
| A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored. | ||||
| CVE-2023-5341 | 3 Fedoraproject, Imagemagick, Redhat | 5 Extra Packages For Enterprise Linux, Fedora, Imagemagick and 2 more | 2026-11-05 | 6.2 Medium |
| A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. | ||||