Export limit exceeded: 419386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419386 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121209 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121109 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low) | ||||
| CVE-2026-121190 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121085 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121225 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2022-30267 | 2026-11-03 | 7.5 High | ||
| Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution. | ||||
| CVE-2022-29966 | 2026-11-03 | 9.8 Critical | ||
| Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition. | ||||
| CVE-2026-121582 | 1 Umami | 1 Umami | 2026-11-03 | 6.5 Medium |
| A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-121115 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-121157 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low) | ||||
| CVE-2026-121143 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121136 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-121033 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121736 | 1 Nocodb | 1 Nocodb | 2026-11-03 | 5.3 Medium |
| NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting. | ||||
| CVE-2026-121734 | 2026-11-03 | 6.5 Medium | ||
| ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials. | ||||
| CVE-2026-121732 | 1 Rosariosis | 1 Rosariosis | 2026-11-03 | 2.7 Low |
| RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation. | ||||
| CVE-2026-121731 | 1 Rosariosis | 1 Rosariosis | 2026-11-03 | 8.8 High |
| RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements. | ||||
| CVE-2026-121730 | 2026-11-03 | 6.5 Medium | ||
| emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients. | ||||
| CVE-2026-121728 | 2026-11-03 | 5.3 Medium | ||
| SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts. | ||||
| CVE-2026-121727 | 2026-11-03 | 7.5 High | ||
| Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory. | ||||