Export limit exceeded: 420554 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420554 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420554 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420554 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-66364 | 1 Samsung Semiconductor | 20 Exynos 1080, Exynos 1280, Exynos 1330 and 17 more | 2026-11-06 | N/A |
| Continuously sending control‑plane messages causes the baseband to crashes. | ||||
| CVE-2025-66365 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| Incorrect handling of SIP packets leads to baseband crashes | ||||
| CVE-2026-122992 | 1 G4klx | 1 Dstargateway | 2026-11-06 | N/A |
| In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field. | ||||
| CVE-2026-35495 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability | ||||
| CVE-2026-48176 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| A memory corruption vulnerability caused by improper validation of messages | ||||
| CVE-2026-77442 | 2026-11-06 | 5.9 Medium | ||
| Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0. | ||||
| CVE-2026-48179 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service | ||||
| CVE-2026-33972 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation. | ||||
| CVE-2026-33969 | 1 Samsung Semiconductor | 19 Exynos 1280, Exynos 1330, Exynos 1380 and 16 more | 2026-11-06 | N/A |
| In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service. | ||||
| CVE-2026-33971 | 1 Samsung Semiconductor | 15 Exynos 1280, Exynos 1330, Exynos 1380 and 12 more | 2026-11-06 | N/A |
| In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition. | ||||
| CVE-2026-33958 | 1 Samsung Semiconductor | 15 Exynos 1080, Exynos 1280, Exynos 1330 and 12 more | 2026-11-06 | N/A |
| Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition. | ||||
| CVE-2025-66368 | 1 Samsung Semiconductor | 3 Exynos 1080, Exynos 9110, Exynos Modem 5123 | 2026-11-06 | N/A |
| Incorrect handling of SDP payload leads to a Denial of Service | ||||
| CVE-2025-66367 | 1 Samsung Semiconductor | 18 Exynos 1280, Exynos 1330, Exynos 1380 and 15 more | 2026-11-06 | N/A |
| Improper handling of NAS DLTransport messages may lead to a baseband crash. | ||||
| CVE-2026-33965 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-06 | N/A |
| An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow. | ||||
| CVE-2025-66366 | 1 Samsung Semiconductor | 10 Exynos 1280, Exynos 1330, Exynos 1380 and 7 more | 2026-11-06 | N/A |
| Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash | ||||
| CVE-2026-69044 | 1 Samsung Semiconductor | 4 Exynos 1580, Exynos 1680, Exynos 2500 and 1 more | 2026-11-06 | N/A |
| In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption. | ||||
| CVE-2026-69043 | 1 Samsung Semiconductor | 7 Exynos 1480, Exynos 1580, Exynos 1680 and 4 more | 2026-11-06 | N/A |
| In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption | ||||
| CVE-2026-123851 | 1 Jetbrains | 1 Junie Github Action | 2026-11-06 | 5.4 Medium |
| In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters | ||||
| CVE-2026-123824 | 1 Sensiolabs | 1 Symfony | 2026-11-06 | 6.3 Medium |
| The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external file:// entity. XmlUtils::parse() sets $dom->validateOnParse = true before calling loadXML() and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during loadXML(), and LIBXML_NONET blocks http:// but not file://, so a file:// entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as s3://, a parameter entity can also send the content of a local file to an external server. This is the same issue as CVE-2026-45071, which was fixed in the DomCrawler component but not in Config. Applications are affected if they pass untrusted XML to XmlUtils::parse() directly. The Symfony components that call it process developer-provided or operator-configured sources, such as configuration files and the XLIFF documents fetched by the translation providers. | ||||
| CVE-2026-122053 | 1 Sensiolabs | 1 Symfony | 2026-11-06 | 6.5 Medium |
| The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11. ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted. The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored. | ||||