Export limit exceeded: 419555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419555 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86974 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-04 | 7.5 High |
| A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption. | ||||
| CVE-2026-84590 | 1 Apple | 1 Macos | 2026-11-04 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination or heap corruption. | ||||
| CVE-2026-84528 | 1 Apple | 1 Macos | 2026-11-04 | 3.3 Low |
| A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-65384 | 1 Apple | 1 Macos | 2026-11-04 | 7.5 High |
| An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may cause an unexpected process termination. | ||||
| CVE-2026-118170 | 1 Strapi | 1 Strapi Open Source And Enterprise Headless Cms | 2026-11-04 | 9.1 Critical |
| The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document. | ||||
| CVE-2026-55292 | 1 Google | 1 Android | 2026-11-04 | 5.3 Medium |
| In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58838 | 1 Google | 1 Android | 2026-11-04 | 4 Medium |
| In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59044 | 1 Google | 1 Android | 2026-11-04 | 8.4 High |
| In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59043 | 1 Google | 1 Android | 2026-11-04 | 7.4 High |
| In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59042 | 1 Google | 1 Android | 2026-11-04 | 7.4 High |
| In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59031 | 1 Google | 1 Android | 2026-11-04 | 6.2 Medium |
| In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59028 | 1 Google | 1 Android | 2026-11-04 | 8.4 High |
| In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59021 | 1 Google | 1 Android | 2026-11-04 | 6.2 Medium |
| In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59020 | 1 Google | 1 Android | 2026-11-04 | 5.9 Medium |
| In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59016 | 1 Google | 1 Android | 2026-11-04 | 8.4 High |
| In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59015 | 1 Google | 1 Android | 2026-11-04 | 4 Medium |
| In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59014 | 1 Google | 1 Android | 2026-11-04 | 8.4 High |
| In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58926 | 1 Google | 1 Android | 2026-11-04 | 2.5 Low |
| A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process. | ||||
| CVE-2026-122124 | 2026-11-04 | 6.1 Medium | ||
| On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device. | ||||
| CVE-2026-122148 | 2026-11-04 | N/A | ||
| In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network. | ||||