Export limit exceeded: 414966 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414966 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58847 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-125338 | 2026-11-10 | 4.5 Medium | ||
| Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14. | ||||
| CVE-2026-120803 | 2026-11-10 | 7.1 High | ||
| A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific aggregation pipeline. | ||||
| CVE-2026-58994 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-13595 | 3 Kernel, Linux, Redhat | 10 Util-linux, Util-linux, Cost Management On Premise and 7 more | 2026-11-10 | 6.8 Medium |
| A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | ||||
| CVE-2026-58927 | 1 Google | 1 Android | 2026-11-10 | 6.7 Medium |
| The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process. | ||||
| CVE-2026-115539 | 2026-11-10 | N/A | ||
| SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted. | ||||
| CVE-2026-58930 | 1 Google | 1 Android | 2026-11-10 | 7.8 High |
| An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element. | ||||
| CVE-2026-58977 | 1 Google | 1 Android | 2026-11-10 | 6.7 Medium |
| In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59599 | 2026-11-10 | N/A | ||
| Android on supported Pixel devices before security patch level 2026-11-05 allows elevation of privilege in the hypervisor subcomponent in the kernel, aka A-519434175. | ||||
| CVE-2026-123293 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting | ||||
| CVE-2026-123301 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 8.2 High |
| In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible | ||||
| CVE-2026-123302 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery | ||||
| CVE-2026-18142 | 1 Ibm | 1 Mq | 2026-11-10 | 7.1 High |
| IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow. | ||||
| CVE-2026-123304 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path | ||||
| CVE-2026-123305 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 7.5 High |
| In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host | ||||
| CVE-2026-123306 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 7.4 High |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs | ||||
| CVE-2026-123307 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 6.8 Medium |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible | ||||
| CVE-2026-123278 | 1 Jetbrains | 1 Intellij Idea | 2026-11-10 | 6.7 Medium |
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint | ||||
| CVE-2026-118779 | 1 Digitalbazaar | 1 Forge | 2026-11-10 | 7.5 High |
| Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1. | ||||