Export limit exceeded: 218379 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 218379 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 218379 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (218379 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58966 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-18196 | 1 Ibm | 1 App Connect Enterprise | 2026-11-10 | 5.4 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization. | ||||
| CVE-2026-97677 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-11-10 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory. | ||||
| CVE-2026-68993 | 1 Samsung Semiconductor | 2 Exynos 1480, Exynos 2400 | 2026-11-10 | 6.3 Medium |
| A double free vulnerability in NPU driver due to improper pointer management (940) | ||||
| CVE-2026-48186 | 1 Samsung Semiconductor | 13 Exynos 1280, Exynos 1330, Exynos 1380 and 10 more | 2026-11-10 | 9.1 Critical |
| Improper handling of messages before AS security activation can cause unexpected behavior | ||||
| CVE-2026-84229 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 6.5 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests. | ||||
| CVE-2026-114277 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 6.5 Medium |
| Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue. | ||||
| CVE-2026-103866 | 1 Apache | 1 Apache Sling Engine | 2026-11-10 | 7.5 High |
| Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue. | ||||
| CVE-2026-84228 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 3.1 Low |
| IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | ||||
| CVE-2026-84030 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 5.6 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-58965 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-121085 | 1 Google | 1 Chrome | 2026-11-10 | 4.3 Medium |
| Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-124251 | 2026-11-10 | 8.8 High | ||
| Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4. | ||||
| CVE-2026-123180 | 2026-11-10 | 8.8 High | ||
| A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This affects the confidentiality, integrity and availability of the router. | ||||
| CVE-2026-123178 | 2026-11-10 | 4.5 Medium | ||
| An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected device. | ||||
| CVE-2026-97402 | 2026-11-10 | N/A | ||
| In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled. | ||||
| CVE-2026-81542 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 6.4 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. | ||||
| CVE-2026-80435 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 5 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. | ||||
| CVE-2026-18484 | 1 Ibm | 2 Contextforge, Contextforge Mcp Gateway | 2026-11-10 | 6.5 Medium |
| IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions. | ||||
| CVE-2026-102715 | 1 Eclipse | 1 Threadx Netx Duo | 2026-11-10 | N/A |
| In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records. | ||||