Total
417647 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-107262 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28. | |||||
| CVE-2026-86987 | 1 Apple | 2 Ipados, Iphone Os | 2026-10-30 | N/A | 5.5 MEDIUM |
| An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker may be able to access sensitive user data. | |||||
| CVE-2026-76287 | 1 Splunk | 1 Splunk | 2026-10-30 | N/A | 5.4 MEDIUM |
| In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible because the Data Management Representational State Transfer (REST) API verifies the required capability but does not verify that the requested preview job belongs to the requester. The affected Data Management REST API is available only when the Edge Processor feature is turned on. The Edge Processor feature is turned off by default. For more information see Set up a data management control plane (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/getting-started/set-up-a-data-management-control-plane) and Getting sample data for previewing data transformations (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/working-with-pipelines/getting-sample-data-for-previewing-data-transformations) in the Splunk documentation. | |||||
| CVE-2026-76288 | 1 Splunk | 1 Splunk | 2026-10-30 | N/A | 7.5 HIGH |
| In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request. | |||||
| CVE-2026-76289 | 1 Splunk | 1 Splunk | 2026-10-30 | N/A | 6.5 MEDIUM |
| In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service. The vulnerability is possible because the endpoint does not limit resource use when it processes response field selections. For more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation. | |||||
| CVE-2026-76290 | 1 Splunk | 1 Splunk | 2026-10-30 | N/A | 7.5 HIGH |
| In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads). | |||||
| CVE-2026-111497 | 16 7-zip, Andybalholm, Anthropic and 13 more | 26 P7zip, Brotli, Bun and 23 more | 2026-10-30 | N/A | 9.8 CRITICAL |
| A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. | |||||
| CVE-2026-97631 | 2026-10-30 | N/A | N/A | ||
| EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability. | |||||
| CVE-2026-96391 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | |||||
| CVE-2026-96389 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1. | |||||
| CVE-2026-96379 | 2026-10-30 | N/A | 3.5 LOW | ||
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3. | |||||
| CVE-2026-96363 | 2026-10-30 | N/A | 3.1 LOW | ||
| Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | |||||
| CVE-2026-95673 | 2026-10-30 | N/A | N/A | ||
| Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-92243. Reason: This candidate is a reservation duplicate of CVE-2026-92243. Notes: All CVE users should reference CVE-2026-92243 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | |||||
| CVE-2026-95117 | 2026-10-30 | N/A | 3.7 LOW | ||
| Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components | |||||
| CVE-2026-88089 | 2026-10-30 | N/A | 6.7 MEDIUM | ||
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | |||||
| CVE-2026-88088 | 2026-10-30 | N/A | 7.0 HIGH | ||
| Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-88086 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network. | |||||
| CVE-2026-88085 | 2026-10-30 | N/A | 6.4 MEDIUM | ||
| Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-88084 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. | |||||
| CVE-2026-88083 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | |||||