Export limit exceeded: 390669 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390669 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18924 | 2 Curl, Haxx | 2 Curl, Curl | 2026-09-11 | 9.1 Critical |
| A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. | ||||
| CVE-2026-55273 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55277 | 1 Google | 1 Android | 2026-09-11 | 8 High |
| In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55285 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55290 | 1 Google | 1 Android | 2026-09-11 | 3.3 Low |
| In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55294 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-13608 | 2 Curl, Haxx | 2 Curl, Curl | 2026-09-11 | 7.4 High |
| A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation. | ||||
| CVE-2026-42018 | 1 Jfrog | 1 Artifactory | 2026-09-11 | 7.5 High |
| JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | ||||
| CVE-2026-42016 | 1 Jfrog | 1 Artifactory | 2026-09-11 | 8.1 High |
| JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. | ||||
| CVE-2026-84869 | 1 Connectwise | 1 Screenconnect | 2026-09-11 | 9.9 Critical |
| A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted. | ||||
| CVE-2026-87468 | 1 Google | 1 Chrome | 2026-09-11 | 6.5 Medium |
| Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87493 | 1 Google | 1 Chrome | 2026-09-11 | 6.5 Medium |
| Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87519 | 1 Google | 1 Chrome | 2026-09-11 | 6.5 Medium |
| Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87522 | 1 Google | 2 Android, Chrome | 2026-09-11 | 6.5 Medium |
| Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) | ||||
| CVE-2026-89146 | 2026-09-11 | 7.5 High | ||
| libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer. | ||||
| CVE-2026-79396 | 2026-09-11 | N/A | ||
| Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera. | ||||
| CVE-2026-79394 | 2026-09-11 | N/A | ||
| An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP. | ||||
| CVE-2026-79393 | 2026-09-11 | 7.5 High | ||
| A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. | ||||
| CVE-2026-79362 | 2026-09-11 | N/A | ||
| Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code. | ||||
| CVE-2026-71646 | 2026-09-11 | N/A | ||
| An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp | ||||