Export limit exceeded: 425898 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (425898 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-124887 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124888 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124889 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124890 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124891 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Incorrect boundary conditions in the DOM: Selection component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124892 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124893 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124894 1 Mozilla 2 Firefox, Thunderbird 2026-11-15 8.8 High
Use-after-free in the Networking: Cookies component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-55348 1 Google 1 Android 2026-11-15 2.3 Low
In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55360 1 Google 1 Android 2026-11-15 8.4 High
In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56897 1 Google 1 Android 2026-11-15 4.0 Medium
In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56898 1 Google 1 Android 2026-11-15 8.4 High
In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56909 1 Google 1 Android 2026-11-15 6.7 Medium
In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56926 1 Google 1 Android 2026-11-15 8.4 High
In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56935 1 Google 1 Android 2026-11-15 4.0 Medium
In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56938 1 Google 1 Android 2026-11-15 7.0 High
In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-56943 1 Google 1 Android 2026-11-15 2.3 Low
In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56946 1 Google 1 Android 2026-11-15 6.7 Medium
In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56947 1 Google 1 Android 2026-11-15 4.0 Medium
In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56969 1 Google 1 Android 2026-11-15 7.8 High
In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.