Total
417620 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-110176 | 2026-10-31 | N/A | N/A | ||
| The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected. | |||||
| CVE-2026-48383 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 10.0 CRITICAL |
| Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-48398 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 5.4 MEDIUM |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | |||||
| CVE-2026-75732 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 9.9 CRITICAL |
| Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-83662 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 9.3 CRITICAL |
| Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | |||||
| CVE-2026-83958 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 5.4 MEDIUM |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | |||||
| CVE-2026-119124 | 1 Imagemagick | 1 Imagemagick | 2026-10-31 | N/A | 3.3 LOW |
| ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application. | |||||
| CVE-2026-85330 | 1 Microsoft | 1 Edge | 2026-10-31 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-96192 | 1 Microsoft | 1 Edge | 2026-10-31 | N/A | 8.8 HIGH |
| Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-119187 | 1 Digitalbazaar | 1 Forge | 2026-10-31 | N/A | 7.5 HIGH |
| Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1. | |||||
| CVE-2026-119191 | 1 Digitalbazaar | 1 Forge | 2026-10-31 | N/A | 7.5 HIGH |
| Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1. | |||||
| CVE-2026-119209 | 1 Pypdf Project | 1 Pypdf | 2026-10-31 | N/A | 5.5 MEDIUM |
| pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3. | |||||
| CVE-2026-88137 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-31 | N/A | 6.5 MEDIUM |
| Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-88158 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-31 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Microsoft Digest Authentication allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-110081 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 5.4 MEDIUM |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | |||||
| CVE-2026-110082 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 5.4 MEDIUM |
| Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed. | |||||
| CVE-2026-110083 | 1 Adobe | 1 Experience Manager | 2026-10-31 | N/A | 7.1 HIGH |
| Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-97229 | 1 Gitlab | 1 Gitlab | 2026-10-31 | N/A | 10.0 CRITICAL |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | |||||
| CVE-2026-93577 | 1 Gitlab | 1 Gitlab | 2026-10-31 | N/A | 9.9 CRITICAL |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration. | |||||
| CVE-2026-89078 | 1 Gitlab | 1 Gitlab | 2026-10-31 | N/A | 9.9 CRITICAL |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration. | |||||