Export limit exceeded: 425757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425757 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119990 | 1 Microsoft | 1 Azure Open-ai | 2026-11-12 | 9.8 Critical |
| Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-116653 | 1 Tanium | 1 Threat Response | 2026-11-12 | 4.3 Medium |
| Tanium addressed an improper input validation vulnerability in Threat Response. | ||||
| CVE-2026-127211 | 2026-11-12 | 6.5 Medium | ||
| MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach. | ||||
| CVE-2026-64531 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure. | ||||
| CVE-2026-113961 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-12 | 7.5 High |
| An authorization issue was addressed with improved validation. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages. | ||||
| CVE-2026-113960 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-12 | 6.5 Medium |
| This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined. | ||||
| CVE-2026-116654 | 1 Tanium | 1 Threat Response | 2026-11-12 | 6.5 Medium |
| Tanium addressed an improper input validation vulnerability in Threat Response. | ||||
| CVE-2026-112809 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-11-12 | 5.5 Medium |
| Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-112803 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-11-12 | 5.5 Medium |
| Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-89061 | 1 Lenovo | 1 Pc Manager | 2026-11-12 | 7.8 High |
| During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that could allow a local user to escalate privileges. | ||||
| CVE-2026-91870 | 2026-11-12 | 7.4 High | ||
| Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||
| CVE-2026-91872 | 2026-11-12 | 5.5 Medium | ||
| Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-91890 | 2026-11-12 | 8.7 High | ||
| Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access. | ||||
| CVE-2026-91879 | 2026-11-12 | 8.8 High | ||
| Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||
| CVE-2026-91880 | 2026-11-12 | 8.9 High | ||
| Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||
| CVE-2026-91891 | 2026-11-12 | 7.5 High | ||
| Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-91892 | 2026-11-12 | 3.7 Low | ||
| Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-91876 | 2026-11-12 | 5.5 Medium | ||
| Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-91877 | 2026-11-12 | 7.6 High | ||
| Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service. | ||||
| CVE-2026-91873 | 2026-11-12 | 8.7 High | ||
| Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||