Export limit exceeded: 420515 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420515 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420515 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420515 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124031 | 1 Gpac | 1 Gpac | 2026-11-06 | 5.5 Medium |
| GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box. | ||||
| CVE-2026-124030 | 1 Gpac | 1 Gpac | 2026-11-06 | 5.5 Medium |
| GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash. | ||||
| CVE-2026-124029 | 2026-11-06 | 5.7 Medium | ||
| Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory. | ||||
| CVE-2026-124028 | 2026-11-06 | 4.2 Medium | ||
| mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments. | ||||
| CVE-2026-124027 | 2026-11-06 | 7.5 High | ||
| ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query parameters, bypassing the ownership check, to retrieve PDF-rendered pages of any tenant's knowledge-base documents. | ||||
| CVE-2026-124026 | 1 Barassistant | 1 Bar Assistant | 2026-11-06 | 4.3 Medium |
| Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar. | ||||
| CVE-2026-124025 | 1 Ladybirdweb | 1 Faveo Helpdesk | 2026-11-06 | 4.3 Medium |
| Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads. | ||||
| CVE-2026-49923 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49924 | 1 Google | 1 Android | 2026-11-06 | 6.2 Medium |
| In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49931 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-6426 | 2 Qemu, Redhat | 7 Qemu, Enterprise Linux, Enterprise Linux For Nvidia 26 and 4 more | 2026-11-06 | 4.4 Medium |
| A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration. | ||||
| CVE-2026-49934 | 1 Google | 1 Android | 2026-11-06 | 7.8 High |
| In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-62438 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 6.1 Medium |
| A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly. | ||||
| CVE-2026-19703 | 2026-11-06 | N/A | ||
| A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings. | ||||
| CVE-2026-61477 | 2 Libvirt, Redhat | 5 Libvirt, Enterprise Linux, Enterprise Linux For Nvidia 26 and 2 more | 2026-11-06 | 2.3 Low |
| An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root. | ||||
| CVE-2026-55654 | 3 Openbsd, Openssh, Redhat | 9 Openssh, Openssh, Enterprise Linux and 6 more | 2026-11-06 | 3.7 Low |
| A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service. | ||||
| CVE-2026-5419 | 2 Gnu, Redhat | 14 Gnutls, Cert Manager, Discovery and 11 more | 2026-11-06 | 3.7 Low |
| A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure. | ||||
| CVE-2026-77709 | 2026-11-06 | N/A | ||
| A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service. | ||||
| CVE-2026-77708 | 2026-11-06 | N/A | ||
| A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service. | ||||
| CVE-2026-19868 | 2026-11-06 | N/A | ||
| An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). | ||||