Export limit exceeded: 351548 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (351548 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-27648 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 8.8 High |
| in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. | ||||
| CVE-2026-27781 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 3.3 Low |
| in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. | ||||
| CVE-2026-27766 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 5.5 Medium |
| in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak. | ||||
| CVE-2026-45349 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-05-19 | 7.1 High |
| Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key (generated in OWUI) and the Chat ID of another user to continue the conversation of the other user. This vulnerability is fixed in 0.9.0. | ||||
| CVE-2026-25781 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 8.4 High |
| in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered. | ||||
| CVE-2026-25850 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 5.5 Medium |
| in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak | ||||
| CVE-2026-44558 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-05-19 | 5.4 Medium |
| Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the channel router does not call filter_allowed_access_grants on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin's permission framework. This vulnerability is fixed in 0.9.0. | ||||
| CVE-2026-28733 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 6.5 Medium |
| in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution. | ||||
| CVE-2026-33565 | 1 Openharmony | 1 Openharmony | 2026-05-19 | 3.3 Low |
| in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. | ||||
| CVE-2026-47308 | 1 Samsung Open Source | 1 Walrus | 2026-05-19 | 5.5 Medium |
| NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9. | ||||
| CVE-2026-44721 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-05-19 | 7.3 High |
| Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspace.models) to execute arbitrary JavaScript in the browser of any other user (including admins) who views the malicious model in the chat UI. This vulnerability is fixed in 0.9.0. | ||||
| CVE-2026-32994 | 1 Rocket.chat | 1 Rocket.chat | 2026-05-19 | N/A |
| The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content. | ||||
| CVE-2026-47309 | 1 Samsung Open Source | 1 Escargot | 2026-05-19 | 5.5 Medium |
| Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. | ||||
| CVE-2026-47310 | 1 Samsung Open Source | 1 Escargot | 2026-05-19 | 7.8 High |
| Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. | ||||
| CVE-2026-45386 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-05-19 | 4.3 Medium |
| Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the message's is_pinned , pinned_by, pinned_at fields), but in standard channels it only checks read permission, allowing users with read-only access to pin/unpin any message. This vulnerability is fixed in 0.9.5. | ||||
| CVE-2026-6354 | 2026-05-19 | N/A | ||
| Voluntarily withdrawn | ||||
| CVE-2026-8975 | 2026-05-19 | N/A | ||
| Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. | ||||
| CVE-2026-8974 | 2026-05-19 | N/A | ||
| Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11. | ||||
| CVE-2026-8973 | 2026-05-19 | N/A | ||
| Memory safety bugs present in Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151. | ||||
| CVE-2026-8972 | 2026-05-19 | N/A | ||
| Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151. | ||||