Export limit exceeded: 422137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 422137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422137 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-106713 | 2026-11-10 | 7.5 High | ||
| An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component | ||||
| CVE-2025-66368 | 1 Samsung Semiconductor | 3 Exynos 1080, Exynos 9110, Exynos Modem 5123 | 2026-11-10 | 7.5 High |
| Incorrect handling of SDP payload leads to a Denial of Service | ||||
| CVE-2025-66367 | 1 Samsung Semiconductor | 18 Exynos 1280, Exynos 1330, Exynos 1380 and 15 more | 2026-11-10 | 7.5 High |
| Improper handling of NAS DLTransport messages may lead to a baseband crash. | ||||
| CVE-2025-66366 | 1 Samsung Semiconductor | 10 Exynos 1280, Exynos 1330, Exynos 1380 and 7 more | 2026-11-10 | 7.5 High |
| Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash | ||||
| CVE-2025-66364 | 1 Samsung Semiconductor | 20 Exynos 1080, Exynos 1280, Exynos 1330 and 17 more | 2026-11-10 | 7.5 High |
| Continuously sending control‑plane messages causes the baseband to crashes. | ||||
| CVE-2026-125704 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-10 | 7.5 High |
| A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established. | ||||
| CVE-2026-120399 | 1 Redhat | 1 Edge Manager | 2026-11-10 | 7.5 High |
| A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections. | ||||
| CVE-2023-6237 | 4 Netapp, Openssl, Redhat and 1 more | 59 500f, 500f Firmware, 8300 and 56 more | 2026-11-10 | 5.9 Medium |
| Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. | ||||
| CVE-2026-94166 | 2026-11-10 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a before 9.4.1. | ||||
| CVE-2026-123218 | 2 Ibm, Linux | 2 Aspera Faspex, Linux Kernel | 2026-11-10 | 9.8 Critical |
| IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges. | ||||
| CVE-2026-12708 | 2026-11-10 | N/A | ||
| Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound. Impact Exploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected. Mitigation Disable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram. Remediation Upgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows. | ||||
| CVE-2026-124952 | 2026-11-10 | N/A | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45. | ||||
| CVE-2026-124950 | 2026-11-10 | N/A | ||
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124949 | 2026-11-10 | N/A | ||
| Other issue in the SVG component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124947 | 2026-11-10 | N/A | ||
| Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124946 | 2026-11-10 | N/A | ||
| Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124945 | 2026-11-10 | N/A | ||
| Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124944 | 2026-11-10 | N/A | ||
| Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124943 | 2026-11-10 | N/A | ||
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160. | ||||
| CVE-2026-124937 | 2026-11-10 | N/A | ||
| Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160. | ||||