Export limit exceeded: 420025 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420025 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121257 | 1 Google | 1 Chrome | 2026-11-05 | 9.6 Critical |
| Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-121133 | 2 Apple, Google | 2 Macos, Chrome | 2026-11-05 | 8.1 High |
| Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) | ||||
| CVE-2026-121134 | 1 Google | 1 Chrome | 2026-11-05 | 8.8 High |
| Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121135 | 1 Google | 1 Chrome | 2026-11-05 | 8.8 High |
| Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121138 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121141 | 1 Google | 1 Chrome | 2026-11-05 | 5.4 Medium |
| Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121158 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121161 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121162 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-11-05 | 5.4 Medium |
| UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121163 | 1 Google | 1 Chrome | 2026-11-05 | 8.3 High |
| Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-121165 | 1 Google | 2 Android, Chrome | 2026-11-05 | 5.4 Medium |
| UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121199 | 2 Apple, Google | 2 Macos, Chrome | 2026-11-05 | 5.5 Medium |
| Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-121224 | 2 Apple, Google | 2 Macos, Chrome | 2026-11-05 | 8.1 High |
| Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) | ||||
| CVE-2026-120930 | 1 Google | 1 Chrome | 2026-11-05 | 5.4 Medium |
| Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-105330 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched. | ||||
| CVE-2026-105461 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue. | ||||
| CVE-2026-114271 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other party's shopping list ID. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-114272 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-114229 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-109129 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | N/A |
| Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a different order. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||