Export limit exceeded: 419157 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419157 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120754 | 1 Hdfgroup | 1 Hdf5 | 2026-11-03 | 3.3 Low |
| HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029. | ||||
| CVE-2026-84579 | 1 Apple | 1 Macos | 2026-11-03 | 8.8 High |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution. | ||||
| CVE-2026-120755 | 1 Hdfgroup | 1 Hdf5 | 2026-11-03 | 5.5 Medium |
| HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected. | ||||
| CVE-2026-120756 | 1 Hdfgroup | 1 Hdf5 | 2026-11-03 | 6.1 Medium |
| HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory. | ||||
| CVE-2026-86868 | 1 Apple | 1 Macos | 2026-11-03 | 9.1 Critical |
| An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users. | ||||
| CVE-2026-86871 | 1 Apple | 1 Macos | 2026-11-03 | 5.9 Medium |
| An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination. | ||||
| CVE-2026-120757 | 1 Hdfgroup | 1 Hdf5 | 2026-11-03 | 7.1 High |
| HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open. | ||||
| CVE-2026-120758 | 1 Hdfgroup | 1 Hdf5 | 2026-11-03 | 5.5 Medium |
| HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service. | ||||
| CVE-2026-112354 | 2026-11-03 | 9.8 Critical | ||
| Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station. | ||||
| CVE-2026-86907 | 1 Apple | 1 Macos | 2026-11-03 | 4.4 Medium |
| An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain. | ||||
| CVE-2026-86914 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information. | ||||
| CVE-2026-121517 | 1 Irfanview | 1 Irfanview | 2026-11-03 | 5 Medium |
| A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low". | ||||
| CVE-2026-112696 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-03 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-112473 | 1 Apple | 1 Macos | 2026-11-03 | 7.4 High |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac. | ||||
| CVE-2026-112500 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-11-03 | 5.3 Medium |
| A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature. | ||||
| CVE-2026-112691 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-03 | 6.2 Medium |
| An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-112516 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-11-03 | 6.2 Medium |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-112652 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-03 | 5.5 Medium |
| A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An malicious app may be able to bypass certificate validation. | ||||
| CVE-2026-112698 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-03 | 5.5 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-117614 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-03 | 8.8 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. | ||||