Export limit exceeded: 420306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420306 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-22063 | 1 Netapp | 3 E-series Santricity Os Controller, Ontap 9, Storagegrid Webscale | 2026-11-04 | N/A |
| The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products. | ||||
| CVE-2026-122120 | 2026-11-04 | 9 Critical | ||
| In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution. | ||||
| CVE-2026-122220 | 2026-11-04 | 7.4 High | ||
| WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers. | ||||
| CVE-2026-113369 | 1 Sonatype | 1 Nexus Repository Manager | 2026-11-04 | N/A |
| Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user. | ||||
| CVE-2026-113373 | 1 Sonatype | 1 Nexus Repository Manager | 2026-11-04 | N/A |
| Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path. | ||||
| CVE-2026-112560 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-11-04 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory. | ||||
| CVE-2026-112627 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-04 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory. | ||||
| CVE-2026-112554 | 1 Apple | 2 Ios And Ipados, Macos | 2026-11-04 | 7.5 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-86974 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-04 | 7.5 High |
| A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption. | ||||
| CVE-2026-84590 | 1 Apple | 1 Macos | 2026-11-04 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination or heap corruption. | ||||
| CVE-2026-84528 | 1 Apple | 1 Macos | 2026-11-04 | 3.3 Low |
| A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-65384 | 1 Apple | 1 Macos | 2026-11-04 | 7.5 High |
| An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may cause an unexpected process termination. | ||||
| CVE-2026-118170 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-11-04 | 9.1 Critical |
| The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document. | ||||
| CVE-2026-55292 | 1 Google | 1 Android | 2026-11-04 | 5.3 Medium |
| In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58838 | 1 Google | 1 Android | 2026-11-04 | 4 Medium |
| In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59044 | 1 Google | 1 Android | 2026-11-04 | 8.4 High |
| In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59043 | 1 Google | 1 Android | 2026-11-04 | 7.4 High |
| In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59042 | 1 Google | 1 Android | 2026-11-04 | 7.4 High |
| In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59031 | 1 Google | 1 Android | 2026-11-04 | 6.2 Medium |
| In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59028 | 1 Google | 1 Android | 2026-11-04 | 8.4 High |
| In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||