Export limit exceeded: 414975 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414975 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-10511 | 2026-10-27 | 6.4 Medium | ||
| The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-18449 | 2026-10-27 | 7.5 High | ||
| The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | ||||
| CVE-2026-107472 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-10-27 | N/A |
| An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data. | ||||
| CVE-2026-112659 | 1 Apple | 4 Ios And Ipados, Macos, Safari and 1 more | 2026-10-27 | 8.8 High |
| A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-112655 | 1 Apple | 6 Ios And Ipados, Macos, Safari and 3 more | 2026-10-27 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-112614 | 1 Apple | 2 Ios And Ipados, Macos | 2026-10-27 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected app termination. | ||||
| CVE-2026-112415 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-27 | 6.1 Medium |
| An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory. | ||||
| CVE-2026-112556 | 1 Apple | 1 Macos | 2026-10-27 | 4.8 Medium |
| A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context. | ||||
| CVE-2026-112471 | 1 Apple | 1 Macos | 2026-10-27 | 4.3 Medium |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected process termination. | ||||
| CVE-2026-112484 | 1 Apple | 1 Macos | 2026-10-27 | 7.8 High |
| This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to execute arbitrary code with system privileges. | ||||
| CVE-2026-113939 | 1 Apple | 1 Macos | 2026-10-27 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-112626 | 1 Apple | 6 Ios And Ipados, Macos, Safari and 3 more | 2026-10-27 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-113913 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-27 | 6.5 Medium |
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing web content may disclose sensitive information. | ||||
| CVE-2026-112457 | 1 Apple | 1 Macos | 2026-10-27 | 7.1 High |
| A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory. | ||||
| CVE-2026-112708 | 1 Apple | 1 Macos | 2026-10-27 | 5.3 Medium |
| A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory. | ||||
| CVE-2026-116745 | 2 Qloapps, Webkul | 2 Qloapps, Qloapps | 2026-10-27 | 6.5 Medium |
| QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords. | ||||
| CVE-2026-116837 | 2026-10-27 | 8.8 High | ||
| A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device. | ||||
| CVE-2026-88781 | 1 Asus | 1 Motherboards Firmware | 2026-10-27 | N/A |
| Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash. Refer to the 'Security Update for Multiple ASUS Motherboards' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-116734 | 2 Dvidelabs, Flatcc Project | 2 Flatcc, Flatcc | 2026-10-27 | 3.7 Low |
| flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process. | ||||
| CVE-2026-116735 | 1 Libyal | 1 Libpff | 2026-10-27 | 6.1 Medium |
| libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent heap memory or cause crashes. | ||||