Export limit exceeded: 424742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424742 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123439 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123438 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123437 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123435 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123432 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123431 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123430 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123429 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123427 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123426 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123425 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123424 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-125086 | 1 D-link | 1 M60 | 2026-11-10 | 10 Critical |
| A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-125205 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-10 | 5.5 Medium |
| FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service. | ||||
| CVE-2026-113960 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-10 | N/A |
| This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined. | ||||
| CVE-2026-89119 | 2026-11-10 | 9.6 Critical | ||
| SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability. | ||||
| CVE-2026-125082 | 1 Sunkaifei | 1 Flycms | 2026-11-10 | 3.5 Low |
| A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is named 714521a9262e7bc9ca5713c873f57e96a4845352. It is recommended to apply a patch to fix this issue. | ||||
| CVE-2026-125361 | 1 Tencent | 1 Browserskill | 2026-11-10 | 6.3 Medium |
| Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs. | ||||
| CVE-2026-125370 | 1 Kubero-dev | 1 Kubero | 2026-11-10 | 9.8 Critical |
| Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens. | ||||
| CVE-2026-125106 | 1 Wagtail | 1 Wagtail | 2026-11-10 | 6.5 Medium |
| Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2. | ||||