Export limit exceeded: 421352 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421352 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46859 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79213 | 1 Google | 2 Android, Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-81872 | 1 Opentelemetry | 1 Opentelemetry-go | 2026-09-17 | 5.3 Medium |
| OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0. | ||||
| CVE-2026-79211 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79205 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79199 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79190 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79143 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79137 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-79136 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79116 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79067 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79050 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79003 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-92904 | 2 Red Hat, Redhat | 2 Red Hat Satellite 6, Satellite | 2026-09-17 | 4.3 Medium |
| A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations. | ||||
| CVE-2026-66625 | 2 Wcvendors, Wordpress | 2 Wc Vendors Marketplace, Wordpress | 2026-09-17 | 7.6 High |
| Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. | ||||
| CVE-2026-66676 | 2 Matrixaddons, Wordpress | 2 Easy Invoice, Wordpress | 2026-09-17 | 5.3 Medium |
| Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. | ||||
| CVE-2026-92803 | 1 Libretranslate | 1 Libretranslate | 2026-09-17 | 5.3 Medium |
| LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances. | ||||
| CVE-2026-76461 | 1 Cisco | 8 Asyncos, Secure Email, Secure Email Gateway C195 and 5 more | 2026-09-17 | 9.8 Critical |
| A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system. | ||||
| CVE-2026-19640 | 1 Arista | 1 Eos | 2026-09-17 | 4.2 Medium |
| On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks. | ||||
| CVE-2026-73469 | 1 Arista | 1 Eos | 2026-09-17 | 5.8 Medium |
| When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks. | ||||