Export limit exceeded: 46475 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46475 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-26599 | 3 Redhat, Tigervnc, X.org | 9 Enterprise Linux, Rhel Aus, Rhel E4s and 6 more | 2026-11-04 | 7.8 High |
| An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later. | ||||
| CVE-2025-3155 | 3 Debian, Gnome, Redhat | 26 Debian Linux, Yelp, Codeready Linux Builder and 23 more | 2026-11-04 | 7.4 High |
| A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. | ||||
| CVE-2026-87085 | 1 Tanium | 1 Provision | 2026-11-04 | 6.5 Medium |
| Tanium addressed a SQL injection vulnerability in Provision. | ||||
| CVE-2026-120554 | 2 Carazo, Wordpress-extensions | 2 Import And Export Users And Customers, Import And Export Users And Customers | 2026-11-04 | 8.8 High |
| The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file. | ||||
| CVE-2026-118675 | 1 N8n | 1 N8n | 2026-11-04 | 7.1 High |
| n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values. | ||||
| CVE-2026-118027 | 1 Mozilla | 1 Firefox | 2026-11-04 | 9.1 Critical |
| Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | ||||
| CVE-2026-117920 | 1 Mozilla | 1 Firefox | 2026-11-04 | 9.6 Critical |
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117919 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-114598 | 1 The Epics Community | 1 Epics Base | 2026-11-04 | 7.5 High |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. | ||||
| CVE-2026-108302 | 1 Tanium | 1 Comply | 2026-11-04 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-108301 | 1 Tanium | 1 Comply | 2026-11-04 | 6 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-117910 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 7.3 High |
| Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-121039 | 1 Google | 1 Chrome | 2026-11-04 | 5.3 Medium |
| Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-121116 | 1 Google | 1 Chrome | 2026-11-04 | 5.3 Medium |
| Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121232 | 1 Google | 1 Chrome | 2026-11-04 | 5.1 Medium |
| Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) | ||||
| CVE-2024-10295 | 1 Redhat | 2 3scale, 3scale Api Management | 2026-11-04 | 7.5 High |
| A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream. | ||||
| CVE-2023-4853 | 2 Quarkus, Redhat | 23 Quarkus, Apache Camel Quarkus, Build Of Optaplanner and 20 more | 2026-11-04 | 8.1 High |
| A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. | ||||
| CVE-2026-121199 | 1 Google | 1 Chrome | 2026-11-04 | 5.5 Medium |
| Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-121091 | 1 Google | 1 Chrome | 2026-11-04 | 5.3 Medium |
| Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121041 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||