Search

Expected end of text, found '/' (at char 36), (line:1, col:37)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (416842 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-113691 2026-10-29 N/A
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
CVE-2026-113690 2026-10-29 N/A
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
CVE-2026-113689 2026-10-29 N/A
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
CVE-2026-113688 2026-10-29 N/A
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
CVE-2026-112706 1 Apple 4 Ios And Ipados, Tvos, Visionos and 1 more 2026-10-29 5.5 Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112701 1 Apple 1 Ios And Ipados 2026-10-29 5.5 Medium
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112685 1 Apple 5 Ios And Ipados, Macos, Tvos and 2 more 2026-10-29 5.5 Medium
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112678 1 Apple 4 Ios And Ipados, Macos, Visionos and 1 more 2026-10-29 5.5 Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112675 1 Apple 1 Macos 2026-10-29 5.5 Medium
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.
CVE-2026-112658 1 Apple 2 Ios And Ipados, Macos 2026-10-29 5.5 Medium
This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. An app may be able to access sensitive user data.
CVE-2026-112618 1 Apple 2 Ios And Ipados, Visionos 2026-10-29 5.5 Medium
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112617 1 Apple 1 Macos 2026-10-29 5.5 Medium
An information disclosure issue was addressed with improved logic. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data.
CVE-2026-112609 1 Apple 1 Ios And Ipados 2026-10-29 5.5 Medium
This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112559 1 Apple 4 Ios And Ipados, Macos, Visionos and 1 more 2026-10-29 5.5 Medium
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112547 1 Apple 1 Ios And Ipados 2026-10-29 5.5 Medium
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112533 1 Apple 1 Macos 2026-10-29 5.5 Medium
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.
CVE-2026-112506 1 Apple 1 Macos 2026-10-29 5.5 Medium
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data.
CVE-2026-112455 1 Apple 5 Ios And Ipados, Macos, Tvos and 2 more 2026-10-29 5.5 Medium
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-111850 2026-10-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
CVE-2026-104109 1 Error311 1 Filerise 2026-10-29 6.8 Medium
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission who can upload or otherwise place an attacker-controlled ZIP in that folder can place an ordinary archive entry beneath the link. ZipArchive::extractTo() can then overwrite an external file, and post-extraction cleanup can delete that target through the same linked parent, only where the FileRise process has the required filesystem write or removal permission. The advisory does not establish that the attacker can create the prerequisite symlink through FileRise. This issue is fixed in version 3.23.0.