Export limit exceeded: 10219 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11185 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413888 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413888 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413888 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413888 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113249 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-22 | 8.8 High |
| Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113272 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113112 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113059 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113126 | 1 Google | 1 Chrome | 2026-10-22 | 9.6 Critical |
| Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78801 | 2026-10-22 | N/A | ||
| An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch | ||||
| CVE-2026-78846 | 2026-10-22 | N/A | ||
| AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing. | ||||
| CVE-2026-92709 | 1 Rsyslog | 1 Rsyslog | 2026-10-22 | 8.1 High |
| Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches. | ||||
| CVE-2026-94482 | 1 Vercel | 1 Next.js | 2026-10-22 | 7.5 High |
| Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1. | ||||
| CVE-2026-98121 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313e_wdt_probe() doesn't set the driver data for the platform device. As a result, dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() will return NULL, leading to a NULL pointer dereference afterward. Set the platform device driver data in msc313e_wdt_probe(). | ||||
| CVE-2026-114610 | 2026-10-22 | 6.5 Medium | ||
| fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image() processing. Repeating references at each nesting level makes the in-memory object count and processing work grow exponentially, allowing a small user-controlled SVG to consume excessive CPU and memory, raise MemoryError, fail PDF generation jobs, and reduce or exhaust worker capacity. ResourceAccessPolicy does not prevent the issue because the references are inline and require no external resource, XML entity, local file, or permissive network setting. This issue is fixed in version 2.8.8. | ||||
| CVE-2026-98122 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every MDBE_ATTR_SRC_LIST member, accepts the all-zeros address. A source list is only accepted on a (*, G) entry, whose source is the all-zeros address, and for each member of the list an (S, G) entry is derived from it by substituting the source. Entries are keyed by a plain memcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present and holds the all-zeros address and the source list holds it as well, the derived (S, G) key is byte-identical to the (*, G) key and resolves to the same entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is then left with a zero address family. vxlan_mdb_remote_src_del() removes the forwarding entry of a source before freeing the source entry: vxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr); vxlan_mdb_remote_src_entry_del(ent); With the keys aliased, the first call deletes the remote of the entry that owns 'ent' instead of a separate (S, G) entry, and frees 'ent'. The second call then runs on the freed entry, and its hlist_del() reads ->pprev and ->next out of it and writes through them. Adding the (*, G) entry with NLM_F_REPLACE and no source list marks the all-zeros source for deletion and reaches this from the sweep at the end of vxlan_mdb_remote_srcs_replace(). BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70 Read of size 8 at addr ffff888102852500 by task poc/84 __vxlan_mdb_add+0x1cd/0xd70 vxlan_mdb_add+0xc0/0x140 rtnl_mdb_add+0x157/0x2a0 rtnetlink_rcv_msg+0x207/0x5a0 Allocated by task 84: __kmalloc_cache_noprof+0x153/0x360 vxlan_mdb_remote_srcs_add+0x2eb/0x440 __vxlan_mdb_add+0x803/0xd70 Freed by task 84: kfree+0x14c/0x3b0 vxlan_mdb_remote_del+0x129/0x1a0 __vxlan_mdb_del+0x4f/0xe0 vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0 __vxlan_mdb_add+0x1c5/0xd70 The MDB operations are netns-scoped, so an unprivileged user can perform them in a new user and network namespace. Reject the all-zeros address in vxlan_mdb_is_valid_source(), which covers both call sites. A (*, G) entry is expressed by omitting the source, so nothing legitimate is refused. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> | ||||
| CVE-2026-114609 | 2026-10-22 | 5.8 Medium | ||
| fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8. | ||||
| CVE-2026-92892 | 1 Jfrog | 1 Jfrog-cli | 2026-10-22 | 9 Critical |
| Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later. | ||||
| CVE-2026-87951 | 1 Drupal | 1 Saml Sso - Service Provider | 2026-10-22 | 3.8 Low |
| Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-87950 | 1 Drupal | 1 Saml Sso - Service Provider | 2026-10-22 | 5.3 Medium |
| Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-87949 | 1 Drupal | 1 Saml Sso - Service Provider | 2026-10-22 | 3.3 Low |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-87948 | 1 Drupal | 1 Saml Sso - Service Provider | 2026-10-22 | 3.5 Low |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-87947 | 1 Drupal | 1 Saml Sso - Service Provider | 2026-10-22 | 4.8 Medium |
| Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-87946 | 1 Drupal | 1 Saml Sso - Service Provider | 2026-10-22 | 4.8 Medium |
| Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||