Export limit exceeded: 422179 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422179 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82509 | 2026-11-10 | 7.4 High | ||
| V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured. | ||||
| CVE-2026-124863 | 2026-11-10 | N/A | ||
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-124862 | 2026-11-10 | N/A | ||
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7. | ||||
| CVE-2026-124861 | 2026-11-10 | N/A | ||
| Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-124860 | 2026-11-10 | N/A | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-124859 | 2026-11-10 | N/A | ||
| Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-124858 | 2026-11-10 | N/A | ||
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-124857 | 2026-11-10 | N/A | ||
| Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-124856 | 2026-11-10 | N/A | ||
| Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7. | ||||
| CVE-2026-124855 | 2026-11-10 | N/A | ||
| Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7. | ||||
| CVE-2026-124854 | 2026-11-10 | N/A | ||
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7. | ||||
| CVE-2026-124853 | 2026-11-10 | N/A | ||
| Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. | ||||
| CVE-2026-109736 | 1 Mozilla | 1 Firefox | 2026-11-10 | 8.1 High |
| Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.45. | ||||
| CVE-2026-118024 | 1 Mozilla | 1 Firefox | 2026-11-10 | 8.8 High |
| Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7. | ||||
| CVE-2026-118021 | 1 Mozilla | 1 Firefox | 2026-11-10 | 8.8 High |
| Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7. | ||||
| CVE-2026-118019 | 1 Mozilla | 1 Firefox | 2026-11-10 | 8.8 High |
| Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7. | ||||
| CVE-2026-118007 | 1 Mozilla | 1 Firefox | 2026-11-10 | 8.8 High |
| Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Thunderbird 159, and Firefox ESR 153.7. | ||||
| CVE-2026-9669 | 1 Python | 1 Cpython | 2026-11-10 | 5.9 Medium |
| bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | ||||
| CVE-2026-93990 | 2 Libexpat, Libexpat Project | 2 Expat, Libexpat | 2026-11-10 | 7.5 High |
| Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds. | ||||
| CVE-2026-8376 | 2 Perl, Shay | 2 Perl, Perl | 2026-11-10 | 7.3 High |
| Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time. | ||||