Export limit exceeded: 419269 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419269 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113022 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted PDF file. (Chromium security severity: Medium) | ||||
| CVE-2026-113191 | 2 Apple, Google | 2 Macos, Chrome | 2026-11-04 | 8.8 High |
| UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113069 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113263 | 1 Google | 2 Android, Chrome | 2026-11-04 | 9.6 Critical |
| Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113018 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113301 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113094 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113240 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113281 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113198 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113070 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Use after free in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113337 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113319 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113166 | 1 Google | 2 Android, Chrome | 2026-11-04 | 8.8 High |
| Improper input validation in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-113289 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-112999 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113307 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-113897 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-04 | 10 Critical |
| This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox. | ||||
| CVE-2026-99246 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-04 | 8.1 High |
| In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock. This permits bearer teardown to free a link while the trace callback is dumping it: CPU 0 CPU 1 trace_tipc_node_reset_links() tipc_node_dump() l = n->links[0].link tipc_node_write_lock() kfree(l) n->links[0].link = NULL tipc_node_write_unlock() tipc_link_dump(l) tipc_link_dump() then dereferences the stale pointer. KASAN reported: BUG: KASAN: slab-use-after-free in tipc_link_dump Read of size 4 by task poc/115 Call Trace: tipc_link_dump+0x10cb/0x16b0 tipc_node_dump+0x4bb/0x740 trace_event_raw_event_tipc_node_class+0x258/0x360 tipc_node_reset_links+0x14d/0x1a0 tipc_rcv+0x13f5/0x3030 tipc_udp_recv+0x4e3/0x670 Allocated by task 0: tipc_link_create+0x1e1/0x1020 tipc_node_check_dest+0x7d2/0x11a0 tipc_disc_rcv+0xdbf/0x1430 Freed by task 89: kfree+0x131/0x3c0 tipc_node_link_down+0x267/0x4b0 tipc_node_delete_links+0xec/0x160 bearer_disable+0x107/0x260 Take the node write lock around the trace event. This serializes the dump against tipc_node_link_down(delete=true), which frees the link under the same write lock. | ||||
| CVE-2026-119977 | 2 Wordpress, Wordpress Foundation | 2 Wordpress, Wordpress | 2026-11-04 | 8.1 High |
| WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | ||||