Export limit exceeded: 419386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419386 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15343 | 1 Github | 1 Enterprise Server | 2026-11-03 | N/A |
| A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/, because path validation did not check the actual write destination. The initial fix in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18 was incomplete because validation checked the supplied symlink target, while the publisher wrote the file using its directory and name. Writing GitHub Actions workflow files required the Dependabot installation to have workflows: write permission. Depending on repository permissions and workflow configuration, including a relevant pull_request_target workflow or auto-merge, an injected workflow could execute with access to GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fully fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2026-121581 | 1 Arcreel | 1 Arcreel | 2026-11-03 | 4.3 Medium |
| A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-121175 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121042 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121055 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121159 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121029 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121142 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121169 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121539 | 1 Miroslavpejic85 | 1 Mirotalk P2p | 2026-11-03 | 6.3 Medium |
| A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component. | ||||
| CVE-2026-121095 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-96386 | 1 Drupal | 1 Smart Content | 2026-11-03 | 6.5 Medium |
| Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | ||||
| CVE-2026-96377 | 1 Drupal | 1 Combined Image Style | 2026-11-03 | 5.3 Medium |
| Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7. | ||||
| CVE-2026-92909 | 1 Adobe | 3 Adobe Commerce, Adobe Commerce B2b, Magento Open Source | 2026-11-03 | 9.8 Critical |
| Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-76025 | 1 Google | 1 Chrome | 2026-11-03 | 8.8 High |
| Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-65385 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-03 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. A buffer overflow may result in memory corruption and unexpected app termination. | ||||
| CVE-2026-119271 | 1 Google | 1 Chrome | 2026-11-03 | 8.8 High |
| Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-119269 | 1 Google | 1 Chrome | 2026-11-03 | 8.8 High |
| Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-113344 | 1 Google | 1 Chrome | 2026-11-03 | 8.8 High |
| Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-113324 | 1 Google | 1 Chrome | 2026-11-03 | 8.8 High |
| Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||