Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425948 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48173 | 1 Samsung Semiconductor | 19 Exynos 1280, Exynos 1330, Exynos 1380 and 16 more | 2026-11-15 | 9.8 Critical |
| In the NAS message handler, improper validation of the length field in NAS message causes memory corruption | ||||
| CVE-2026-111495 | 1 Tpc Software | 1 Matchpoint | 2026-11-15 | N/A |
| API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element. | ||||
| CVE-2026-123283 | 1 Jetbrains | 1 Datalore | 2026-11-15 | 6.8 Medium |
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account | ||||
| CVE-2026-123292 | 1 Jetbrains | 1 Datalore | 2026-11-15 | 2.7 Low |
| In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid | ||||
| CVE-2026-84473 | 1 Kiteworks | 1 Owncloud | 2026-11-15 | 9.8 Critical |
| Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint. | ||||
| CVE-2026-90975 | 1 Realtek | 1 Rtusba64.sys | 2026-11-15 | 7.8 High |
| A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution. | ||||
| CVE-2026-122113 | 1 Realtek | 1 Rtusba64.sys | 2026-11-15 | 4.3 Medium |
| A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required. | ||||
| CVE-2026-123589 | 1 Hickory-dns | 1 Hickory-dns | 2026-11-15 | 5.3 Medium |
| The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service. | ||||
| CVE-2026-82663 | 2026-11-15 | 7.5 High | ||
| The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution. | ||||
| CVE-2026-82568 | 2026-11-15 | 7.5 High | ||
| The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires the existence of at least one Peer-to-Peer campaign. This vulnerability can be combined with CVE-2026-82663 to achieve unauthenticated remote code execution. | ||||
| CVE-2026-121841 | 1 Mozilla | 1 Firefox For Ios | 2026-11-15 | 7.3 High |
| Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0. | ||||
| CVE-2026-19552 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-15 | N/A |
| When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked. | ||||
| CVE-2026-121687 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-15 | 9.8 Critical |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22) | ||||
| CVE-2026-113965 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-15 | 5.4 Medium |
| This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction. | ||||
| CVE-2026-113970 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-15 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory. | ||||
| CVE-2026-107242 | 1 Versa | 1 Vos | 2026-11-15 | 9.1 Critical |
| The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled. | ||||
| CVE-2020-9709 | 1 Adobe | 1 Photoshop | 2026-11-15 | 8.8 High |
| Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability. Successful exploitation could lead to privilege escalation. | ||||
| CVE-2026-124959 | 2 Hnswlib, Spotify | 2 Hnswlib, Voyager | 2026-11-15 | 7.1 High |
| The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file. | ||||
| CVE-2026-121688 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-15 | 9.1 Critical |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code. | ||||
| CVE-2026-113960 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-15 | 6.5 Medium |
| This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined. | ||||