Export limit exceeded: 424768 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424768 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-88710 | 1 Asus | 1 Router Firmware | 2026-11-11 | N/A |
| Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-82012 | 2026-11-11 | 7.8 High | ||
| Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-20320 | 1 Cisco | 5 Broadworks, Broadworks Application Delivery Platform, Broadworks Application Server and 2 more | 2026-11-11 | 7.5 High |
| A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user. | ||||
| CVE-2026-125350 | 1 Google | 1 Chrome | 2026-11-11 | 8.8 High |
| Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-125348 | 2026-11-11 | 8.8 High | ||
| Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-125347 | 2026-11-11 | 9.6 Critical | ||
| Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-125344 | 2026-11-11 | 8.8 High | ||
| Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-125343 | 2026-11-11 | 8.3 High | ||
| Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-124036 | 2026-11-11 | 7.1 High | ||
| Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required. | ||||
| CVE-2026-120017 | 2026-11-11 | 10 Critical | ||
| SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application. | ||||
| CVE-2026-120009 | 2026-11-11 | 7.2 High | ||
| SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-115791 | 2026-11-11 | N/A | ||
| When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files. | ||||
| CVE-2026-111793 | 2 Openwave, Openwave Messaging | 2 Webtop Media Transcoder, Webtop Media Transcoder | 2026-11-11 | 4.3 Medium |
| Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. | ||||
| CVE-2026-111560 | 1 Barracuda Networks | 6 Barracuda Email Security Gateway, Barracuda Load Balancer Application Delivery Controller, Barracuda Message Archiver and 3 more | 2026-11-11 | N/A |
| Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. | ||||
| CVE-2026-109805 | 2026-11-11 | 6.4 Medium | ||
| Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application. | ||||
| CVE-2026-109803 | 2026-11-11 | 9.9 Critical | ||
| SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application. | ||||
| CVE-2026-109795 | 2026-11-11 | 9.9 Critical | ||
| SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-118368 | 1 Akaunting | 1 Akaunting | 2026-11-11 | N/A |
| Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin. | ||||
| CVE-2026-59191 | 2026-11-11 | N/A | ||
| TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2. | ||||
| CVE-2026-59192 | 2026-11-11 | N/A | ||
| TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2. | ||||