Export limit exceeded: 408530 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408530 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408530 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107036 | 2026-11-02 | 5.1 Medium | ||
| Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application. | ||||
| CVE-2026-106804 | 1 Kamailio | 1 Kamailio | 2026-11-02 | 7.5 High |
| A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service. | ||||
| CVE-2026-117069 | 1 Openairinterface | 1 Oai-cn5g-amf | 2026-11-02 | N/A |
| An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process. | ||||
| CVE-2025-22436 | 1 Google | 1 Android | 2026-11-02 | N/A |
| In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28632 | 1 Google | 1 Android | 2026-11-02 | N/A |
| In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-45514 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55262 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58836 | 1 Google | 1 Android | 2026-11-02 | 7.8 High |
| In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58853 | 1 Google | 1 Android | 2026-11-02 | 7.5 High |
| In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58866 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58985 | 1 Google | 1 Android | 2026-11-02 | N/A |
| In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58989 | 1 Google | 1 Android | 2026-11-02 | N/A |
| In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-91895 | 1 Dell | 1 Alienware Command Center | 2026-11-02 | 7.1 High |
| Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering. | ||||
| CVE-2026-91897 | 1 Dell | 1 Alienware Command Center | 2026-11-02 | 6.4 Medium |
| Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service. | ||||
| CVE-2026-115215 | 1 Eclipse | 1 Threadx | 2026-11-02 | N/A |
| In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions. | ||||
| CVE-2026-120447 | 1 Bufanyun | 1 Hotgo | 2026-11-02 | 8.1 High |
| HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators. | ||||
| CVE-2026-113940 | 1 Apple | 1 Macos | 2026-11-02 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-112492 | 1 Apple | 1 Macos | 2026-11-02 | 7 High |
| A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | ||||
| CVE-2026-65385 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-02 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. A buffer overflow may result in memory corruption and unexpected app termination. | ||||
| CVE-2026-107057 | 2026-11-02 | 9.8 Critical | ||
| An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip. | ||||