Export limit exceeded: 26330 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396220 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93372 | 1 Google | 2 Android, Chrome | 2026-09-21 | 9.6 Critical |
| Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-69353 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-21 | 5.5 Medium |
| Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83411 | 1 Oracle | 1 Coherence | 2026-09-21 | 8.8 High |
| Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-69371 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-21 | 8 High |
| Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69381 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-21 | 4.6 Medium |
| Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack. | ||||
| CVE-2026-69393 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-21 | 5.7 Medium |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-65492 | 2 Dokan Wordpress Plugin, Wordpress | 2 Dokan Pro, Wordpress | 2026-09-21 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7. | ||||
| CVE-2026-69617 | 1 Microsoft | 4 Windows 11 26h1, Windows 11 26h1, Windows Server 2025 and 1 more | 2026-09-21 | 7 High |
| Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-91742 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-21 | 4.8 Medium |
| Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-93381 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-21 | 8.8 High |
| Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) | ||||
| CVE-2026-91865 | 1 Apache | 1 Neethi | 2026-09-21 | 7.5 High |
| A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue. | ||||
| CVE-2026-91864 | 1 Apache | 1 Neethi | 2026-09-21 | 7.5 High |
| A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue. | ||||
| CVE-2026-91863 | 1 Apache | 1 Neethi | 2026-09-21 | 7.5 High |
| A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue. | ||||
| CVE-2026-90306 | 1 Linux | 1 Linux Kernel | 2026-09-21 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hw_breakpoint_cfi_handler() from ARM, making it not steal breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless CFI is actively used in the kernel. When not instrumenting with CFI, or when a breakpoint is issued in userspace, we fall through to return 1 from hw_breakpoint_pending() "unhandled fault" so userspace can make use of this breakpoint. Tested with LKDTM and this command line: echo CFI_FORWARD_PROTO > /sys/kernel/debug/provoke-crash/DIRECT still works as expected. | ||||
| CVE-2026-90211 | 1 Linux | 1 Linux Kernel | 2026-09-21 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPF_PROBE_ATOMIC and gets an exception table entry, but bpf_jit_probe_atomic_pre() only fills in the arena base and the probe offset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which bpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads back as "there is nothing to clear". That is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory, but an RMW carrying BPF_FETCH also reads the old value into a register: src_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for BPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes at the landing pad with whatever that register held before the atomic instead of the 0 that every other BPF_PROBE_* access delivers. Fill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64, s390x does not report arena violations from its exception handler, so there is no access direction to correct here, only the missing register clear. | ||||
| CVE-2026-72131 | 1 Linux | 1 Linux Kernel | 2026-09-21 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag. Apply the existing workaround for M1 of reserving two tags for the admin queue to A11. | ||||
| CVE-2026-87976 | 1 Apache | 2 Nifi, Nifi Registry | 2026-09-21 | 8.1 High |
| Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized path to remain a strict child of the storage root location. | ||||
| CVE-2024-50492 | 2 Scott Paterson, Wpplugin | 2 Scottcart, Scottcart | 2026-09-21 | 8.3 High |
| Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart scottcart allows Code Injection.This issue affects ScottCart: from n/a through <= 1.1. | ||||
| CVE-2026-92701 | 1 Ultravioletrs | 1 Cocos | 2026-09-21 | 9.1 Critical |
| Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body policy before quote validation, so structurally valid TDX QuoteV4 Evidence is accepted without checking that its REPORT_DATA field matches the reportData expected for the current session. A relying party using this path can therefore accept Evidence with a mismatched or reused reportData and release application data after the handshake, enabling session-misbinding to an unintended attestation context. The issue is fixed in version 0.9.0. | ||||
| CVE-2026-69403 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-21 | 5.5 Medium |
| Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | ||||