Export limit exceeded: 420046 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420046 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121607 | 1 Qihoo 360 | 4 D600-2, D603-2, D606-6 and 1 more | 2026-11-04 | 10 Critical |
| A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-112423 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-04 | 6.1 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents. | ||||
| CVE-2026-121173 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121207 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-118237 | 1 Github | 1 Enterprise Server | 2026-11-04 | N/A |
| An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2026-121735 | 1 Blueprintue | 1 Blueprintue-self-hosted-edition | 2026-11-04 | 3.7 Low |
| blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job. | ||||
| CVE-2026-121606 | 1 Qihoo 360 | 6 D600-2, D603-2, D606-6 and 3 more | 2026-11-04 | 10 Critical |
| A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification of cryptographic signature. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-113013 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121031 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-121248 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-84594 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-11-04 | 5.5 Medium |
| A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-112417 | 1 Apple | 1 Visionos | 2026-11-04 | 7.8 High |
| An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption. | ||||
| CVE-2026-116646 | 1 Tanium | 1 Threat Response | 2026-11-04 | 4.3 Medium |
| Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. | ||||
| CVE-2026-116654 | 1 Tanium | 1 Threat Response | 2026-11-04 | 6.5 Medium |
| Tanium addressed an improper input validation vulnerability in Threat Response. | ||||
| CVE-2026-116663 | 1 Tanium | 1 Enforce | 2026-11-04 | 6.5 Medium |
| Tanium addressed an improper access controls vulnerability in Enforce. | ||||
| CVE-2026-120775 | 1 Tanium | 1 Deploy | 2026-11-04 | 7.2 High |
| Tanium addressed a heap-based buffer overflow vulnerability in Deploy. | ||||
| CVE-2026-116661 | 1 Tanium | 1 Enforce | 2026-11-04 | 6.5 Medium |
| Tanium addressed an improper access controls vulnerability in Enforce. | ||||
| CVE-2026-104608 | 1 Github | 1 Enterprise Server | 2026-11-04 | N/A |
| A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2026-112540 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to unexpected app termination. | ||||
| CVE-2026-112669 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-04 | 6.5 Medium |
| A race condition was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||