Export limit exceeded: 423953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56410 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | ||||
| CVE-2026-56409 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.5 Medium |
| xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | ||||
| CVE-2026-56408 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| libexpat before 2.8.2 has an integer overflow in copyString. | ||||
| CVE-2026-56407 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | ||||
| CVE-2026-56406 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | ||||
| CVE-2026-56405 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| libexpat before 2.8.2 has an integer overflow in getAttributeId. | ||||
| CVE-2026-56404 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| libexpat before 2.8.2 has an integer overflow in addBinding. | ||||
| CVE-2026-56403 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| libexpat before 2.8.2 has an integer overflow in storeAtts. | ||||
| CVE-2026-56132 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 6.9 Medium |
| In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | ||||
| CVE-2026-56131 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 4.9 Medium |
| libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). | ||||
| CVE-2026-54872 | 1 Openssl | 1 Openssl | 2026-11-10 | 3.7 Low |
| Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path. | ||||
| CVE-2026-53400 | 1 Linux | 1 Linux Kernel | 2026-11-10 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free. Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration. | ||||
| CVE-2026-53223 | 1 Linux | 1 Linux Kernel | 2026-11-10 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership. | ||||
| CVE-2026-50219 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 4.9 Medium |
| libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, | ||||
| CVE-2026-48962 | 1 Pmqs | 1 Compress | 2026-11-10 | 7.3 High |
| IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege. | ||||
| CVE-2026-48959 | 1 Pmqs | 1 Io::uncompress::unzip | 2026-11-10 | 7.5 High |
| IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap. | ||||
| CVE-2026-45186 | 1 Libexpat Project | 1 Libexpat | 2026-11-10 | 2.9 Low |
| In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | ||||
| CVE-2026-42497 | 2 Archive\, Bingos | 2 \, Archive::tar | 2026-11-10 | 7.5 High |
| Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone. | ||||
| CVE-2026-42496 | 2 Archive\, Bingos | 2 \, Archive::tar | 2026-11-10 | 9.1 Critical |
| Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path. | ||||
| CVE-2026-3276 | 1 Python | 1 Cpython | 2026-11-10 | 5.3 Medium |
| unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. | ||||