Export limit exceeded: 11105 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 30148 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30148 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-83538 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 5.3 Medium |
| Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-118483 | 2026-11-10 | 8.2 High | ||
| Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-58817 | 1 Google | 1 Android | 2026-11-10 | 6.2 Medium |
| In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-118484 | 2026-11-10 | 6.5 Medium | ||
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | ||||
| CVE-2026-113573 | 2026-11-10 | 5.9 Medium | ||
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-123260 | 2026-11-10 | 4 Medium | ||
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-122101 | 2026-11-10 | 3.7 Low | ||
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-126077 | 2026-11-10 | 6.8 Medium | ||
| Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users. Applications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a :hybrid serializer migration configured, and run behind a cache that stores Set-Cookie on public responses. This is a path around the fix for CVE-2024-26144. This issue is fixed in versions 8.1.4.1 and 8.0.5.2. | ||||
| CVE-2026-113562 | 2026-11-10 | 7.7 High | ||
| Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-113558 | 2026-11-10 | 8.6 High | ||
| Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-113557 | 2026-11-10 | 8.6 High | ||
| Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-88089 | 1 Microsoft | 10 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 7 more | 2026-11-10 | 6.7 Medium |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | ||||
| CVE-2026-113534 | 2026-11-10 | 8.6 High | ||
| After Effects is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-124941 | 2026-11-10 | 4.3 Medium | ||
| Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124930 | 2026-11-10 | 4.3 Medium | ||
| Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124929 | 2026-11-10 | 4.3 Medium | ||
| Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124909 | 2026-11-10 | 4.3 Medium | ||
| Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-58838 | 1 Google | 1 Android | 2026-11-10 | 4 Medium |
| In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58930 | 1 Google | 1 Android | 2026-11-10 | 7.8 High |
| An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element. | ||||
| CVE-2026-90975 | 1 Realtek | 1 Rtusba64.sys | 2026-11-10 | 7.8 High |
| A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution. | ||||