Export limit exceeded: 425888 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425888 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113963 | 1 Apple | 3 Ios And Ipados, Visionos, Watchos | 2026-11-15 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, tvOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data. | ||||
| CVE-2026-113968 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-15 | 5.4 Medium |
| A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts. | ||||
| CVE-2026-63282 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 6.5 Medium |
| Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation. | ||||
| CVE-2026-14918 | 1 Axis Communications Ab | 3 Axis File Player, Signed Media Verifier, Signed Video Framework | 2026-11-15 | 5.3 Medium |
| The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected. | ||||
| CVE-2026-88710 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-88707 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-9063 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 6.7 Medium |
| A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-14543 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 3.9 Low |
| The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-13387 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 3.5 Low |
| A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions. | ||||
| CVE-2026-63287 | 1 Axis Communications Ab | 2 Axis Camera Station, Axis Camera Station Pro | 2026-11-15 | 6.5 Medium |
| It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station. | ||||
| CVE-2026-128824 | 2 Red Hat, Redhat | 5 Red Hat Quay 3, Mirror Registry, Quay and 2 more | 2026-11-15 | 5.4 Medium |
| A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session. | ||||
| CVE-2026-88709 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-88708 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-110989 | 2026-11-15 | N/A | ||
| The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields. | ||||
| CVE-2026-114452 | 2026-11-15 | N/A | ||
| The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment. | ||||
| CVE-2026-123707 | 1 Wordpress-extensions | 1 Wpgraphql | 2026-11-15 | N/A |
| The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses. | ||||
| CVE-2026-129443 | 1 Itsourcecode | 1 Airline Reservation System | 2026-11-15 | 6.3 Medium |
| A vulnerability was determined in itsourcecode Airline Reservation System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-116559 | 2026-11-15 | N/A | ||
| The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata. | ||||
| CVE-2026-110960 | 2026-11-15 | N/A | ||
| The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account. | ||||
| CVE-2026-110987 | 2026-11-15 | N/A | ||
| The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link. | ||||