Export limit exceeded: 412646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412646 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56592 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | 6.5 Medium |
| HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access. | ||||
| CVE-2026-110166 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110167 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110168 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110169 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-56595 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | 3.1 Low |
| HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim. | ||||
| CVE-2026-110170 | 1 Google | 1 Chrome | 2026-10-14 | 4.3 Medium |
| Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110171 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110172 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-56597 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | 3.1 Low |
| HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets. | ||||
| CVE-2026-21806 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-14 | 3.1 Low |
| HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions. | ||||
| CVE-2026-53564 | 2026-10-14 | N/A | ||
| Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2. | ||||
| CVE-2025-4953 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-10-14 | 7.4 High |
| A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible. | ||||
| CVE-2026-92160 | 2026-10-14 | 6.5 Medium | ||
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-83787 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-14 | 5.5 Medium |
| Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-83681 | 1 Microsoft | 1 Power Toys | 2026-10-14 | 5.5 Medium |
| Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-92155 | 2026-10-14 | 7.5 High | ||
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0. | ||||
| CVE-2026-73793 | 2026-10-14 | 7.9 High | ||
| HPE NonStop Middleware software has secret key handling and data deserialization vulnerability. | ||||
| CVE-2026-34073 | 2 Cryptography.io, Pyca | 2 Cryptography, Cryptography | 2026-10-14 | 5.3 Medium |
| cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6. | ||||
| CVE-2026-110624 | 1 Papermerge | 1 Papermerge | 2026-10-14 | 3.1 Low |
| Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to. | ||||