Export limit exceeded: 419886 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419886 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16491 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-04 | 6.5 Medium |
| Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope. | ||||
| CVE-2026-12887 | 1 Octopus | 1 Octopus Server | 2026-11-04 | N/A |
| In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory. | ||||
| CVE-2026-117878 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117877 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117876 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117875 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117874 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117872 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117865 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117862 | 1 Mozilla | 1 Firefox | 2026-11-04 | 9.8 Critical |
| Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117860 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 8.1 High |
| Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116660 | 1 Tanium | 1 Enforce | 2026-11-04 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Enforce. | ||||
| CVE-2026-116658 | 1 Tanium | 1 Enforce | 2026-11-04 | 6.5 Medium |
| Tanium addressed a denial of service vulnerability in Enforce. | ||||
| CVE-2026-116649 | 1 Tanium | 1 Enforce | 2026-11-04 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Enforce. | ||||
| CVE-2026-116647 | 1 Tanium | 1 Comply | 2026-11-04 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Comply. | ||||
| CVE-2026-116196 | 1 Rclone | 1 Rclone | 2026-11-04 | 5.3 Medium |
| Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys. | ||||
| CVE-2026-116192 | 1 Rclone | 1 Rclone | 2026-11-04 | 5.9 Medium |
| rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures. | ||||
| CVE-2026-116164 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-04 | N/A |
| Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies. | ||||
| CVE-2026-115326 | 1 Webkul | 1 Qloapps | 2026-11-04 | 5.4 Medium |
| QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities. | ||||
| CVE-2026-115216 | 1 Eclipse | 1 Eclipse Iofog | 2026-11-04 | N/A |
| In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret. | ||||