Export limit exceeded: 425861 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425861 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425861 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425861 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59636 | 1 Google | 1 Android | 2026-11-14 | 6.2 Medium |
| In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-95403 | 1 Google | 1 Android | 2026-11-14 | 8.4 High |
| In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-48402 | 1 Adobe | 1 Premiere | 2026-11-14 | 7.8 High |
| Premiere Pro is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-126085 | 1 Rails | 1 Rails | 2026-11-14 | 5.3 Medium |
| Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2. | ||||
| CVE-2026-97054 | 1 Go Standard Library | 1 Net/http | 2026-11-14 | N/A |
| For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header. | ||||
| CVE-2026-124743 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-14 | 5.5 Medium |
| A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution. | ||||
| CVE-2026-0178 | 1 Google | 1 Android | 2026-11-14 | 6.7 Medium |
| In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stream table entries due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-0191 | 1 Google | 1 Android | 2026-11-14 | 7.8 High |
| In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-0193 | 1 Google | 1 Android | 2026-11-14 | 3.3 Low |
| In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-107407 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-128338 | 2 Exceljs, Exceljs Project | 2 Exceljs, Exceljs | 2026-11-14 | 7.5 High |
| exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error. | ||||
| CVE-2026-116615 | 2 Marketingfire, Wordpress-extensions | 2 Widget-options – Advanced Conditional Visibility For Gutenberg Blocks & Classic Widgets, Widget Options | 2026-11-14 | 8.8 High |
| The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above. | ||||
| CVE-2026-126173 | 2026-11-14 | 9.8 Critical | ||
| The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration. | ||||
| CVE-2026-107408 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-107410 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-107411 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-107412 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-107413 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-111342 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-126347 | 1 Tornadoweb | 1 Tornado | 2026-11-14 | 3.1 Low |
| Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1. | ||||