Export limit exceeded: 419286 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419286 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117874 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117873 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.1 High |
| Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117872 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117871 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117865 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.3 Medium |
| Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117864 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117863 | 1 Mozilla | 1 Firefox | 2026-11-04 | 6.5 Medium |
| Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117862 | 1 Mozilla | 1 Firefox | 2026-11-04 | 9.8 Critical |
| Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117861 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 9.6 Critical |
| Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117860 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 8.1 High |
| Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116658 | 1 Tanium | 1 Enforce | 2026-11-04 | 6.5 Medium |
| Tanium addressed a denial of service vulnerability in Enforce. | ||||
| CVE-2026-116649 | 1 Tanium | 1 Enforce | 2026-11-04 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Enforce. | ||||
| CVE-2026-116647 | 1 Tanium | 1 Comply | 2026-11-04 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Comply. | ||||
| CVE-2026-116627 | 1 Devolutions | 1 Powershell Universal | 2026-11-04 | 8.7 High |
| Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL. | ||||
| CVE-2026-116196 | 1 Rclone | 1 Rclone | 2026-11-04 | 5.3 Medium |
| Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys. | ||||
| CVE-2026-116192 | 1 Rclone | 1 Rclone | 2026-11-04 | 5.9 Medium |
| rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures. | ||||
| CVE-2026-116164 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-04 | N/A |
| Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies. | ||||
| CVE-2026-115326 | 1 Webkul | 1 Qloapps | 2026-11-04 | 5.4 Medium |
| QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities. | ||||
| CVE-2026-115216 | 1 Eclipse | 1 Eclipse Iofog | 2026-11-04 | N/A |
| In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret. | ||||
| CVE-2026-113644 | 1 Eclipse | 1 Eclipse Iofog | 2026-11-04 | N/A |
| In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2. | ||||