Export limit exceeded: 29941 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 29941 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419129 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419129 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121565 | 2026-11-03 | 7.4 High | ||
| Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys. | ||||
| CVE-2026-121535 | 1 Miroslavpejic85 | 1 Mirotalk P2p | 2026-11-03 | 3.7 Low |
| A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised. | ||||
| CVE-2026-107016 | 1 Fossifyorg | 1 Contacts | 2026-11-03 | 7.5 High |
| Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | ||||
| CVE-2026-121108 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121106 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium) | ||||
| CVE-2026-121088 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121096 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-121111 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121101 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121093 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-108324 | 2026-11-03 | 6.5 Medium | ||
| Tanium addressed a denial of service vulnerability in Tanium Client. | ||||
| CVE-2026-81239 | 1 Dell | 1 Wyse Management Suite | 2026-11-03 | 8.6 High |
| Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | ||||
| CVE-2026-79206 | 1 Google | 1 Chrome | 2026-11-03 | 6.5 Medium |
| Out of bounds read in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78892 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-11-03 | 7.1 High |
| Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-73466 | 2026-11-03 | 6.3 Medium | ||
| On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks. | ||||
| CVE-2026-7312 | 1 Progress | 1 Sitefinity | 2026-11-03 | 10 Critical |
| CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration. | ||||
| CVE-2026-67305 | 1 Freerdp | 1 Freerdp | 2026-11-03 | 8.8 High |
| FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation. | ||||
| CVE-2026-57580 | 1 Goauthentik | 1 Authentik | 2026-11-03 | N/A |
| authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5. | ||||
| CVE-2026-51772 | 1 Openstack | 1 Glance | 2026-11-03 | 6.5 Medium |
| A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request | ||||
| CVE-2026-45434 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-03 | 9.8 Critical |
| Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. | ||||