Export limit exceeded: 421049 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421049 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421049 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112470 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-04 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-112605 | 1 Apple | 1 Xcode | 2026-11-04 | 3.3 Low |
| This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files. | ||||
| CVE-2026-121931 | 1 Linksys | 1 Wrt54gl | 2026-11-04 | 9.1 Critical |
| A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-64789 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may bypass Gatekeeper checks. | ||||
| CVE-2026-86923 | 1 Apple | 1 Macos | 2026-11-04 | 3.3 Low |
| An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-113934 | 1 Apple | 1 Macos | 2026-11-04 | 7.8 High |
| The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-84542 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| An access issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to read files outside of its sandbox. | ||||
| CVE-2026-112477 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-04 | 7 High |
| A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-117867 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-121930 | 1 Linksys | 1 Wrt54gl | 2026-11-04 | 9.1 Critical |
| A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-81009 | 1 Linux | 1 Linux Kernel | 2026-11-04 | 4.7 Medium |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-9212 | 1 Netgear | 47 Lbr1020, Lbr1020 Firmware, Lbr20 and 44 more | 2026-11-04 | 8.0 High |
| Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations. | ||||
| CVE-2026-87897 | 1 Nextcloud | 1 Whiteboard | 2026-11-04 | N/A |
| A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard. | ||||
| CVE-2026-87086 | 1 Tanium | 1 Provision | 2026-11-04 | 7.5 High |
| Tanium addressed a denial of service vulnerability in Provision. | ||||
| CVE-2026-82986 | 1 Nextcloud | 1 Tables | 2026-11-04 | N/A |
| The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. | ||||
| CVE-2026-82983 | 1 Nextcloud | 1 Tables | 2026-11-04 | 4.3 Medium |
| The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels. | ||||
| CVE-2026-77172 | 1 Nextcloud | 1 Server | 2026-11-04 | N/A |
| App passwords were allowed to bypass password confirmation on sensitive endpoints. | ||||
| CVE-2026-16491 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-04 | 6.5 Medium |
| Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope. | ||||
| CVE-2026-12887 | 1 Octopus | 1 Octopus Server | 2026-11-04 | N/A |
| In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory. | ||||
| CVE-2026-117878 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||