Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413238 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413238 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112939 | 1 Tox-dev | 1 Filelock | 2026-10-21 | 4.7 Medium |
| filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-112940 | 1 Tox-dev | 1 Filelock | 2026-10-21 | 7.1 High |
| filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-107447 | 2026-10-21 | 5.3 Medium | ||
| The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total. | ||||
| CVE-2026-114265 | 1 Projectworlds | 1 Advanced Library Management System | 2026-10-21 | 6.3 Medium |
| A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-113018 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113019 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-114492 | 1 Gin-vue-admin Project | 1 Gin-vue-admin | 2026-10-21 | 6.5 Medium |
| gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process. | ||||
| CVE-2026-114491 | 1 Pdfmake | 1 Pdfmake | 2026-10-21 | 5.3 Medium |
| pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF. | ||||
| CVE-2026-113022 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113025 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-112941 | 1 Tox-dev | 1 Filelock | 2026-10-21 | 3.3 Low |
| filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-113027 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113012 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-113029 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-112992 | 1 Google | 1 Chrome | 2026-10-21 | 9.6 Critical |
| Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-112993 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-112995 | 1 Google | 1 Chrome | 2026-10-21 | 8.8 High |
| Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113007 | 1 Google | 1 Chrome | 2026-10-21 | 9.6 Critical |
| Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113014 | 1 Google | 1 Chrome | 2026-10-21 | 9.6 Critical |
| Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-114264 | 1 Projectworlds | 1 Advanced Library Management System | 2026-10-21 | 4.7 Medium |
| A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||