Export limit exceeded: 420527 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420527 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420527 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123848 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 7.4 High |
| In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates | ||||
| CVE-2026-123849 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 7 High |
| In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers | ||||
| CVE-2026-123850 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives | ||||
| CVE-2026-3832 | 2 Gnu, Redhat | 11 Gnutls, Cert Manager, Discovery and 8 more | 2026-11-06 | 3.7 Low |
| A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust. | ||||
| CVE-2026-112554 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-06 | 7.5 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2023-38375 | 1 Ibm | 1 Cloud Pak System | 2026-11-06 | 6.1 Medium |
| IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-56717 | 2026-11-06 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-26084 | 1 Fortinet | 5 Fortisandbox, Fortisandbox Cloud, Fortisandbox Paas and 2 more | 2026-11-06 | 8.9 High |
| A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests. | ||||
| CVE-2026-28621 | 1 Google | 1 Android | 2026-11-06 | 4.0 Medium |
| In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-123855 | 1 Jetbrains | 1 Toolbox | 2026-11-06 | 7.5 High |
| In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs | ||||
| CVE-2026-106134 | 1 Progress | 1 Kendoreact | 2026-11-06 | 5.4 Medium |
| Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item. | ||||
| CVE-2026-106136 | 1 Progress | 1 Kendoreact | 2026-11-06 | 5.4 Medium |
| Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action. | ||||
| CVE-2026-106143 | 1 Progress | 1 Kendo Ui For Vue | 2026-11-06 | 5.4 Medium |
| Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link. | ||||
| CVE-2026-106128 | 1 Progress | 1 Kendo Ui For Vue | 2026-11-06 | 4.1 Medium |
| Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability. | ||||
| CVE-2026-103984 | 1 Freescout Helpdesk | 1 Freescout | 2026-11-06 | 6.5 Medium |
| FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231. | ||||
| CVE-2026-103985 | 1 Freescout Helpdesk | 1 Freescout | 2026-11-06 | 7.1 High |
| FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231. | ||||
| CVE-2026-10147 | 2026-11-06 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-10146 | 2026-11-06 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49126 | 2026-11-06 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49125 | 2026-11-06 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||