Export limit exceeded: 420036 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420036 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117977 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117978 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117979 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-22058 | 1 Netapp | 1 Storagegrid | 2026-11-05 | N/A |
| StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests. | ||||
| CVE-2026-22060 | 1 Netapp | 1 Storagegrid | 2026-11-05 | N/A |
| All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid. | ||||
| CVE-2026-116472 | 2026-11-05 | 2.7 Low | ||
| A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx. Due to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly. In principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway. | ||||
| CVE-2026-112451 | 1 Apple | 1 Macos | 2026-11-05 | 8.2 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service or disclose process memory. | ||||
| CVE-2026-112453 | 1 Apple | 1 Macos | 2026-11-05 | 7.7 High |
| A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox. | ||||
| CVE-2026-112454 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-05 | 8.2 High |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory. | ||||
| CVE-2026-112500 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-11-05 | 5.3 Medium |
| A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature. | ||||
| CVE-2026-112455 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-05 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-112456 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-05 | 7.8 High |
| An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to heap corruption. | ||||
| CVE-2026-112494 | 1 Apple | 1 Macos | 2026-11-05 | 5.5 Medium |
| A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks. | ||||
| CVE-2026-112495 | 1 Apple | 1 Macos | 2026-11-05 | 7.1 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-112505 | 1 Apple | 1 Macos | 2026-11-05 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious Screen Sharing peer may be able to corrupt process memory. | ||||
| CVE-2026-118494 | 2026-11-05 | N/A | ||
| Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication. | ||||
| CVE-2026-117957 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117958 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-85286 | 1 Sysadminsmedia | 1 Homebox | 2026-11-05 | 3.7 Low |
| HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0. | ||||
| CVE-2026-85287 | 1 Sysadminsmedia | 1 Homebox | 2026-11-05 | 6.5 Medium |
| HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0. | ||||