Export limit exceeded: 419214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419214 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84604 | 1 Apple | 1 Macos | 2026-11-04 | 7.8 High |
| A stack buffer overflow was addressed through improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted audit file may corrupt process memory. | ||||
| CVE-2026-86984 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access information about a user's contacts. | ||||
| CVE-2026-86992 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-11-04 | 7.5 High |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination. | ||||
| CVE-2026-86880 | 1 Apple | 1 Ios And Ipados | 2026-11-04 | 5.5 Medium |
| This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-112570 | 1 Apple | 1 Macos | 2026-11-04 | 8.2 High |
| An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox. | ||||
| CVE-2026-65368 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| A logic issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A maliciously crafted disk image may bypass Gatekeeper checks. | ||||
| CVE-2026-86985 | 1 Apple | 4 Ios And Ipados, Macos, Safari and 1 more | 2026-11-04 | 6.5 Medium |
| This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash. | ||||
| CVE-2026-84633 | 1 Apple | 1 Macos | 2026-11-04 | 9 Critical |
| A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox. | ||||
| CVE-2026-118027 | 1 Mozilla | 1 Firefox | 2026-11-04 | 3.4 Low |
| Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | ||||
| CVE-2026-22058 | 1 Netapp | 1 Storagegrid | 2026-11-04 | N/A |
| StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests. | ||||
| CVE-2026-108949 | 1 Apache | 2 Activemq, Activemq Broker | 2026-11-04 | N/A |
| Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map. Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions in the map. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; ActiveMQ Broker: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue. | ||||
| CVE-2026-108946 | 1 Apache | 2 Activemq, Activemq Broker | 2026-11-04 | N/A |
| Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows: * an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check. * a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription * a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue. | ||||
| CVE-2026-110022 | 2 Phoenix Contact, Phoenixcontact | 2 Plcnext Engineer, Plcnext Engineer | 2026-11-04 | 8.4 High |
| The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems. | ||||
| CVE-2026-113261 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113332 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113262 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-113149 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113206 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113185 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-113042 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | ||||