Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86962 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-09 | 5.5 Medium |
| A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-121034 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-11-09 | 9.6 Critical |
| Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121038 | 1 Google | 1 Chrome | 2026-11-09 | 6.5 Medium |
| Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121039 | 1 Google | 1 Chrome | 2026-11-09 | 5.3 Medium |
| Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-121041 | 1 Google | 1 Chrome | 2026-11-09 | 6.5 Medium |
| Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121043 | 1 Google | 1 Chrome | 2026-11-09 | 5.4 Medium |
| UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-119613 | 1 Ash-project | 1 Ash Ai | 2026-11-09 | N/A |
| Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller. This issue affects ash_ai: from 1.5.0 before 1.5.1. | ||||
| CVE-2026-112171 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data. | ||||
| CVE-2026-112170 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates. | ||||
| CVE-2026-112169 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification. | ||||
| CVE-2026-112168 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets. | ||||
| CVE-2026-92546 | 1 Keepnet Labs Cybersecurity | 1 Agentic Ai / Agentic Ally | 2026-11-09 | 7.5 High |
| Authentication bypass by spoofing vulnerability in Keepnet Labs Ltd. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e. | ||||
| CVE-2026-116337 | 1 Qt | 3 Qt, Qt Framework, Qtbase | 2026-11-09 | 4.3 Medium |
| Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module. | ||||
| CVE-2026-113702 | 1 Iomad | 1 Iomad | 2026-11-09 | 4.3 Medium |
| A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor. | ||||
| CVE-2024-38002 | 1 Liferay | 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more | 2026-11-09 | 8.8 High |
| The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API. | ||||
| CVE-2024-42002 | 1 Open Source Robotics Foundation | 1 Robot Operating System 2 (ros 2) | 2026-11-09 | 8.4 High |
| A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code. | ||||
| CVE-2024-58398 | 1 Coder | 1 Coder | 2026-11-09 | 4.3 Medium |
| Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing. | ||||
| CVE-2024-2323 | 1 Wso2 | 8 Identity Server, Wso2 Api Manager, Wso2 Carbon User Manager Kernel and 5 more | 2026-11-09 | 4.8 Medium |
| The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise. | ||||
| CVE-2026-124589 | 1 Lxtgh | 1 Omg-seg | 2026-11-09 | 6.3 Medium |
| A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-124588 | 1 Huggingface | 1 Finetrainers | 2026-11-09 | 6.3 Medium |
| A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||