Export limit exceeded: 237706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (237706 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59635 | 1 Google | 1 Android | 2026-11-14 | 7.8 High |
| In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-95397 | 1 Google | 1 Android | 2026-11-14 | 7.8 High |
| In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-95401 | 1 Google | 1 Android | 2026-11-14 | 7.8 High |
| In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-95784 | 2026-11-14 | 7.5 High | ||
| A vulnerability exists in a system component that may, under certain conditions, disrupt the availability of affected services. Successful exploitation could result in temporary service interruption or loss of functionality. | ||||
| CVE-2026-97033 | 2026-11-14 | N/A | ||
| Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo. | ||||
| CVE-2026-126720 | 2026-11-14 | N/A | ||
| Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface. | ||||
| CVE-2026-119237 | 1 Facebook | 1 Proxygen | 2026-11-14 | N/A |
| In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-65951 | 2026-11-14 | 5.8 Medium | ||
| A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted TAR.GZ update package. | ||||
| CVE-2026-111335 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-111336 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-120864 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-109478 | 1 Microsoft | 10 .net 8.0 Installed On Linux, .net 8.0 Installed On Mac Os, .net 8.0 Installed On Windows and 7 more | 2026-11-14 | 7.5 High |
| Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96048 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 4.7 Medium |
| Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96053 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96059 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Use after free in HID class driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111333 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in an authentication request can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-124946 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 3.4 Low |
| Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124947 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124949 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 3.4 Low |
| Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124950 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 3.4 Low |
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||