Export limit exceeded: 418270 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418270 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111565 | 2026-11-02 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-58873 | 2026-11-02 | 8.4 High | ||
| In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55262 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-116768 | 1 Absolute | 1 Secure Access | 2026-11-02 | N/A |
| CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time. | ||||
| CVE-2026-116671 | 1 Xpdf | 1 Xpdf | 2026-11-02 | 5.5 Medium |
| Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image. | ||||
| CVE-2026-115748 | 1 Apache | 1 Vysper | 2026-11-02 | 8.8 High |
| **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative. | ||||
| CVE-2026-115721 | 1 Apache | 1 Vysper | 2026-11-02 | 7.5 High |
| **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative. | ||||
| CVE-2026-115418 | 1 Aws | 1 Aws-cdk Aws-redshift-alpha | 2026-11-02 | 7.3 High |
| SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC. | ||||
| CVE-2026-112545 | 1 Apple | 1 Macos | 2026-11-02 | 7.8 High |
| A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | ||||
| CVE-2026-105476 | 2026-11-02 | 8.8 High | ||
| Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges. | ||||
| CVE-2026-105475 | 2026-11-02 | N/A | ||
| Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. | ||||
| CVE-2026-103310 | 2026-11-02 | 5.3 Medium | ||
| The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment. | ||||
| CVE-2022-2862 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2026-11-02 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 9.0.0221. | ||||
| CVE-2022-2819 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2026-11-02 | 7.8 High |
| Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. | ||||
| CVE-2022-2817 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2026-11-02 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 9.0.0213. | ||||
| CVE-2026-120752 | 2026-11-02 | 7.5 High | ||
| PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code. | ||||
| CVE-2026-58821 | 1 Google | 1 Android | 2026-11-02 | N/A |
| In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58824 | 1 Google | 1 Android | 2026-11-02 | N/A |
| In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58826 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58827 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||