Export limit exceeded: 415459 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 28242 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415459 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415459 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117907 | 2026-10-27 | N/A | ||
| Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117911 | 2026-10-27 | N/A | ||
| Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117912 | 2026-10-27 | N/A | ||
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117915 | 2026-10-27 | N/A | ||
| Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117892 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117893 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117897 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-91768 | 2 Php, Php Group | 2 Php, Php | 2026-10-27 | 6.5 Medium |
| The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint. | ||||
| CVE-2026-69577 | 1 Microsoft | 5 Windows Server 2019, Windows Server 2019 (server Core Installation), Windows Server 2022 and 2 more | 2026-10-27 | 7.5 High |
| Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69789 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-10-27 | 7.5 High |
| Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-92842 | 2 Php, Php Group | 2 Php, Php | 2026-10-27 | 5.9 Medium |
| The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output. | ||||
| CVE-2026-117509 | 1 Crownpku | 1 Rasa Nlu Chi | 2026-10-27 | 6.3 Medium |
| A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-117860 | 2026-10-27 | N/A | ||
| Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-117861 | 2026-10-27 | N/A | ||
| Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-117870 | 2026-10-27 | N/A | ||
| Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-100749 | 2 Svenbluege, Svenbluege.de | 2 Event Gallery, Event Gallery For Joomla | 2026-10-27 | 4.3 Medium |
| Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted. | ||||
| CVE-2026-107458 | 2026-10-27 | N/A | ||
| This CVE has been rejected by Upstream, as they failed to create a meaningful exploit | ||||
| CVE-2026-104189 | 2026-10-27 | 7.5 High | ||
| The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents even when the link share was protected by a password. `PublicFileController` extended `OCP\AppFramework\Controller` and marked its routes `#[PublicPage]`. Nextcloud only enforces share passwords through `PublicShareMiddleware`, which returns early for any controller that is not an `OCP\AppFramework\PublicShareController` instance — so no password, expiry, or share-type check ran for these routes. `ShareFileService::loadLinkShare()` compounded this by treating any token that `getShareByToken()` matched as authorised. A share token is the part of the URL that people paste into chats, emails, and tickets. Password protection exists precisely for the case where holding the token should not by itself grant access, and that guarantee did not hold. Requests to `GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}` returned `200` with the full file body for password-protected shares, with no password and no session. Nextcloud's own share page correctly redirected such requests to the password prompt. Scope is limited to files in the formats this app handles (STL, GLB/glTF, OBJ, STEP, IFC, and the other supported 3D types). Non-3D files in the same share are unaffected. Expired shares returned `500` rather than leaking contents. This issue is fixed in 3.3.2. `PublicFileController` now extends `PublicShareController` and implements `isValidToken()`, `isPasswordProtected()`, and `getPasswordHash()`, delegating password and token validation to the framework and gaining brute-force throttling. `ShareFileService::findValidLinkShare()` additionally rejects share types other than link and email, rejects expired shares, and treats a `ShareNotFound` from the share manager as "no share" instead of letting it surface as a 500. As a workaround, disable the 3D Viewer app (`occ app:disable threedviewer`), or avoid relying on passwords to protect link shares that contain 3D model files, until you can upgrade. | ||||
| CVE-2026-16513 | 1 Zephyrproject | 1 Zephyr | 2026-10-27 | 7.8 High |
| The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the handle out-parameter. On the first loop iteration it executed *handle = sqe, storing the kernel address of the newly acquired submission-queue entry through a pointer taken verbatim from user mode, with no K_SYSCALL_MEMORY_WRITE check in front of it. Any user-mode thread that has been granted a struct rtio kernel object can invoke the syscall with an arbitrary address in handle. That is the ordinary way an unprivileged thread uses the RTIO API, for example via sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally. The store happens in supervisor mode before any submission-entry validation, so it fires regardless of whether the SQE contents are subsequently rejected. Only builds with CONFIG_USERSPACE and CONFIG_RTIO are affected; without CONFIG_USERSPACE the verifier is not compiled and the caller is already privileged. The write address is fully attacker-chosen and the written value is a pointer into the caller's own RTIO ring, whose contents the caller controls (the following *sqe = sqes[i] copies an attacker-supplied struct rtio_sqe into that slot). This yields a write-what-where primitive placing a pointer to attacker-controlled data at any kernel address, sufficient to corrupt kernel function pointers, thread structures, or memory-domain partition tables, and thus to escalate from user mode to kernel mode, defeating the isolation boundary CONFIG_USERSPACE is meant to enforce. At minimum it is a reliable kernel memory-corruption and crash primitive. The reporter reproduced the write on qemu_x86: a K_USER thread changed a supervisor global from NULL to a live kernel SQE pointer. The fix adds K_SYSCALL_MEMORY_WRITE(handle, sizeof(*handle)) (guarded by the existing optional-NULL semantics) before the loop, so the destination must lie in the calling thread's writable memory domain or the thread is terminated by K_OOPS. The neighbouring verifier z_vrfy_rtio_cqe_get_mempool_buffer(), which checked its buff/buff_len out-parameters only for read although the implementation writes through them, was hardened separately by bea93400138 ("rtio: syscalls: validate output params as writable"); that residual was materially weaker, since a read check still confines the target to the caller's own memory domain. | ||||
| CVE-2026-69802 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-27 | 8.1 High |
| Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. | ||||