Export limit exceeded: 410574 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410574 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410574 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68482 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-11319 | 2026-10-19 | 6.2 Medium | ||
| TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges. | ||||
| CVE-2026-100798 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.1 High |
| Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | ||||
| CVE-2026-100799 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 4.3 Medium |
| Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100800 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 9.6 Critical |
| Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | ||||
| CVE-2026-55644 | 2026-10-19 | N/A | ||
| Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0. | ||||
| CVE-2026-100801 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.8 High |
| Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | ||||
| CVE-2026-100802 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 4.3 Medium |
| Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100803 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.1 High |
| Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-105810 | 2026-10-19 | N/A | ||
| Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability. | ||||
| CVE-2026-95209 | 1 Gnu | 1 Gnutls | 2026-10-19 | 5.9 Medium |
| An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS). | ||||
| CVE-2026-102066 | 1 Juniper Networks | 2 Junos Os, Junos Os Evolved | 2026-10-19 | 6.5 Medium |
| A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a malformed RSVP packet when RSVP is enabled on the receiving interface. | ||||
| CVE-2026-107081 | 2026-10-19 | N/A | ||
| SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents. | ||||
| CVE-2023-38375 | 1 Ibm | 1 Cloud Pak System | 2026-10-19 | 6.1 Medium |
| IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-3161 | 1 Ibm | 1 Cloud Pak System | 2026-10-19 | 5.9 Medium |
| IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2026-3295 | 1 Ibm | 1 Cloud Pak System | 2026-10-19 | 7.4 High |
| IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS). | ||||
| CVE-2026-100804 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 9.6 Critical |
| Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100805 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 7.5 High |
| Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100806 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 4.3 Medium |
| Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | ||||
| CVE-2026-100807 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.8 High |
| Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | ||||