Export limit exceeded: 424737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424737 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48186 | 1 Samsung Semiconductor | 13 Exynos 1280, Exynos 1330, Exynos 1380 and 10 more | 2026-11-10 | 9.1 Critical |
| Improper handling of messages before AS security activation can cause unexpected behavior | ||||
| CVE-2026-17402 | 1 Ibm | 1 Api Connect | 2026-11-10 | 9.9 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host. | ||||
| CVE-2026-17172 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party. | ||||
| CVE-2026-125652 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-11-10 | 6.8 Medium |
| A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier. | ||||
| CVE-2026-122014 | 1 Npc-worldwide | 1 Npcpy | 2026-11-10 | 6.3 Medium |
| A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-84229 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 6.5 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests. | ||||
| CVE-2026-109830 | 2026-11-10 | 7.3 High | ||
| A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device. | ||||
| CVE-2026-84228 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 3.1 Low |
| IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | ||||
| CVE-2026-84030 | 1 Ibm | 1 Guardium Data Protection | 2026-11-10 | 5.6 Medium |
| IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-58965 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-121085 | 1 Google | 1 Chrome | 2026-11-10 | 4.3 Medium |
| Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-97402 | 2026-11-10 | N/A | ||
| In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled. | ||||
| CVE-2026-81542 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 6.4 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. | ||||
| CVE-2026-80435 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 5 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. | ||||
| CVE-2026-18484 | 1 Ibm | 2 Contextforge, Contextforge Mcp Gateway | 2026-11-10 | 6.5 Medium |
| IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions. | ||||
| CVE-2026-102715 | 1 Eclipse | 1 Threadx Netx Duo | 2026-11-10 | N/A |
| In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous service discovery write up to three bytes past its transmit packet, corrupting a neighbouring packet or the pool's free list, and misattribute discovered records. | ||||
| CVE-2026-112191 | 2026-11-10 | N/A | ||
| In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3. | ||||
| CVE-2026-121096 | 1 Google | 1 Chrome | 2026-11-10 | 5.5 Medium |
| Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-86336 | 2026-11-10 | N/A | ||
| Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-86531 | 2026-11-10 | N/A | ||
| The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions. | ||||