Export limit exceeded: 418615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 54337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (54337 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117608 | 1 Assimp | 1 Assimp | 2026-11-03 | 6.1 Medium |
| Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory. | ||||
| CVE-2026-28580 | 1 Google | 1 Android | 2026-11-03 | 7.8 High |
| In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-20518 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-11-03 | 4.2 Medium |
| In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10867524 / ALPS10876355; Issue ID: MSV-6674. | ||||
| CVE-2026-121022 | 1 Axxonsoft | 1 Axxon One | 2026-11-03 | 8.1 High |
| Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login. | ||||
| CVE-2026-119729 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-11-03 | 6.5 Medium |
| A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service. | ||||
| CVE-2025-13327 | 2 Astral, Redhat | 3 Uv, Ai Inference Server, Openshift Ai | 2026-11-03 | 6.3 Medium |
| A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package. | ||||
| CVE-2026-77778 | 1 Zohocorp | 1 Manageengine Key Manager Plus | 2026-11-03 | 7.1 High |
| ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults. | ||||
| CVE-2026-77777 | 1 Zohocorp | 1 Manageengine Key Manager Plus | 2026-11-03 | 7.1 High |
| ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials. | ||||
| CVE-2026-110970 | 2 Zak Ad Ubezpiecze Spo Ecznych, Zakład Ubezpieczeń Społecznych | 2 P Atnik, Płatnik | 2026-11-03 | N/A |
| Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.02.002. | ||||
| CVE-2026-109161 | 1 Welotec | 3 Tk100, Tk500 V2, Tk500 V3 | 2026-11-03 | 4.9 Medium |
| Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service. | ||||
| CVE-2026-103653 | 1 Qt | 2 Qt, Qtcoap | 2026-11-03 | N/A |
| An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity). | ||||
| CVE-2026-87853 | 2 Redhat, Sssd | 4 Enterprise Linux, Openshift, Openshift Container Platform and 1 more | 2026-11-03 | 7.5 High |
| A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user. | ||||
| CVE-2026-76955 | 1 Zyxel | 1 Nwa110ax Firmware | 2026-11-03 | 8.8 High |
| A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device. | ||||
| CVE-2026-120830 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-11-03 | 7.4 High |
| A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container. | ||||
| CVE-2026-84599 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-03 | 4.4 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-120740 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-11-03 | 2 Low |
| A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS). | ||||
| CVE-2026-113937 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-113935 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-113942 | 1 Apple | 1 Macos | 2026-11-03 | 7.1 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-120064 | 1 Postgresql | 1 Psqlodbc | 2026-11-03 | 7.5 High |
| Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected. | ||||