Export limit exceeded: 420870 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420870 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420870 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420870 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-49923 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49924 | 1 Google | 1 Android | 2026-11-06 | 6.2 Medium |
| In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49931 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-6426 | 2 Qemu, Redhat | 7 Qemu, Enterprise Linux, Enterprise Linux For Nvidia 26 and 4 more | 2026-11-06 | 4.4 Medium |
| A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration. | ||||
| CVE-2026-49934 | 1 Google | 1 Android | 2026-11-06 | 7.8 High |
| In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-62438 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 6.1 Medium |
| A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly. | ||||
| CVE-2026-61477 | 2 Libvirt, Redhat | 5 Libvirt, Enterprise Linux, Enterprise Linux For Nvidia 26 and 2 more | 2026-11-06 | 2.3 Low |
| An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root. | ||||
| CVE-2026-55654 | 3 Openbsd, Openssh, Redhat | 9 Openssh, Openssh, Enterprise Linux and 6 more | 2026-11-06 | 3.7 Low |
| A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service. | ||||
| CVE-2026-5419 | 2 Gnu, Redhat | 14 Gnutls, Cert Manager, Discovery and 11 more | 2026-11-06 | 3.7 Low |
| A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure. | ||||
| CVE-2026-112552 | 1 Apple | 1 Macos | 2026-11-06 | 9.8 Critical |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with control of a network file server may be able to cause unexpected system termination. | ||||
| CVE-2026-112553 | 1 Apple | 1 Macos | 2026-11-06 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to unexpected app termination. | ||||
| CVE-2026-22629 | 1 Fortinet | 6 Fortianalyzer, Fortianalyzer Cloud, Fortianalyzercloud and 3 more | 2026-11-06 | 3.4 Low |
| An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.10, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow an attacker to bypass bruteforce protections via exploitation of race conditions. The latter raises the complexity of practical exploitation. | ||||
| CVE-2026-27316 | 1 Fortinet | 4 Fortisandbox, Fortisandbox Cloud, Fortisandbox Paas and 1 more | 2026-11-06 | 2.5 Low |
| A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 23.4 all versions, FortiSandbox PaaS 23.3 all versions, FortiSandbox PaaS 23.1 all versions, FortiSandbox PaaS 22.2 all versions, FortiSandbox PaaS 22.1 all versions, FortiSandbox PaaS 21.4 all versions, FortiSandbox PaaS 21.3 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection. | ||||
| CVE-2026-39810 | 1 Fortinet | 1 Forticlientems | 2026-11-06 | 5.2 Medium |
| A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1 may allow attacker to information disclosure via decrypting database dump. | ||||
| CVE-2026-25088 | 1 Fortinet | 1 Fortindr | 2026-11-06 | 4.9 Medium |
| An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | ||||
| CVE-2026-84391 | 1 Fortinet | 1 Fortianalyzer | 2026-11-06 | 5.9 Medium |
| A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via SNMP GETBULK requests. | ||||
| CVE-2026-84388 | 1 Fortinet | 1 Fortipam Chrome Extension | 2026-11-06 | 9.1 Critical |
| A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack | ||||
| CVE-2026-119038 | 1 Perl | 1 Business::gocardless | 2026-11-06 | 6.1 Medium |
| Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect flow back from the GoCardless API and completes it with the token from that response, so the check that the flow is completed by the session that started it always passes. It then creates the requested payment or subscription against the flow's mandate. Since version 1.00, a flow that already has a mandate is returned as confirmed without being completed again, so the same ID creates a new payment on every call. A remote attacker who obtains another customer's redirect flow ID can create payments or subscriptions against that customer's mandate. | ||||
| CVE-2026-116296 | 1 Gitea | 1 Gitea | 2026-11-06 | 6.5 Medium |
| The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories. | ||||
| CVE-2026-103984 | 1 Freescout Helpdesk | 1 Freescout | 2026-11-06 | 6.5 Medium |
| FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231. | ||||