Export limit exceeded: 420133 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420133 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420133 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18082 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82984 | 1 Nextcloud | 1 Server | 2026-11-04 | N/A |
| When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers. | ||||
| CVE-2026-82332 | 1 Watchguard | 1 Fireware Os | 2026-11-04 | N/A |
| An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification. | ||||
| CVE-2026-77173 | 1 Nextcloud | 1 Files Confidential | 2026-11-04 | N/A |
| A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. | ||||
| CVE-2026-77171 | 1 Nextcloud | 1 Collectives | 2026-11-04 | N/A |
| A public shared collective always allowed recipients of the link to create pages. | ||||
| CVE-2026-67400 | 1 Nextcloud | 1 Richdocuments | 2026-11-04 | N/A |
| A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. | ||||
| CVE-2024-27834 | 5 Apple, Fedoraproject, Redhat and 2 more | 11 Ipados, Iphone Os, Macos and 8 more | 2026-11-04 | 5.5 Medium |
| The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. | ||||
| CVE-2024-12125 | 1 Redhat | 1 3scale | 2026-11-04 | 7.5 High |
| A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information. | ||||
| CVE-2024-10963 | 1 Redhat | 5 Enterprise Linux, Openshift, Openshift Ai and 2 more | 2026-11-04 | 7.4 High |
| A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals. | ||||
| CVE-2026-112569 | 1 Apple | 1 Macos | 2026-11-04 | 8.2 High |
| An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox. | ||||
| CVE-2026-86990 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-04 | 5.1 Medium |
| An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission. | ||||
| CVE-2026-110282 | 1 Ibm | 1 Db2 Genius Hub | 2026-11-04 | 6.5 Medium |
| IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control. | ||||
| CVE-2026-116239 | 1 Pgadmin | 1 Pgadmin 4 | 2026-11-04 | 8.5 High |
| In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's login form had looked up, without checking that it came from the source that authenticated the user. The session therefore belonged to another account, with its role, its servers and its saved database passwords: - An LDAP or Kerberos user whose username matched an internal account was logged in as that internal account, including the administrator account created when pgAdmin is first set up. - With internal authentication listed before LDAP or Kerberos in AUTHENTICATION_SOURCES, the login form's internal validation looks up the account whose email was typed and keeps it even though its password does not match. A Kerberos user could type another Kerberos user's principal and be logged in as that user, and an LDAP user could do the same with an LDAP account whose email is their username. Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use. The fix looks the account up by the authenticated username and the source that authenticated it, and no longer uses the account the login form found for any source but internal authentication. Internal authentication logs in that account only if it is an internal account. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19. | ||||
| CVE-2026-112602 | 1 Apple | 1 Xcode | 2026-11-04 | 3.3 Low |
| An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-86968 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-04 | 7.5 High |
| An access issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A malicious app may be able to access restricted system interfaces or launder launch attribution. | ||||
| CVE-2026-112542 | 1 Apple | 1 Macos | 2026-11-04 | 7.5 High |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to intercept network traffic. | ||||
| CVE-2026-20241 | 1 Cisco | 2 Identity Services Engine Passive Identity Connector, Identity Services Engine Software | 2026-11-04 | 5.3 Medium |
| A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate. | ||||
| CVE-2026-121639 | 1 Watchguard | 1 Authpoint Authentication Gateway | 2026-11-04 | N/A |
| A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration. | ||||
| CVE-2026-121583 | 2 Publiccms, Sanluan | 2 Publiccms, Publiccms | 2026-11-04 | 6.3 Medium |
| A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437). | ||||
| CVE-2026-121933 | 1 Linksys | 1 E5350 | 2026-11-04 | 10 Critical |
| A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84542 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| An access issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to read files outside of its sandbox. | ||||