Export limit exceeded: 419947 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419947 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13584 | 1 Mitsubishi Electric Corporation | 115 Ac Servo Melservo-j5 Mr-j5-g, Ac Servo Melservo-j5 Mr-j5-g-hs, Ac Servo Melservo-j5 Mr-j5-g-ll and 112 more | 2026-11-05 | N/A |
| Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800/D800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly. | ||||
| CVE-2026-80335 | 2026-11-05 | 8.4 High | ||
| Memory Corruption when processing firmware update data in Download mode due to a missing bounds check. | ||||
| CVE-2026-79405 | 1 Unisoc | 1 Modem | 2026-11-05 | 7.5 High |
| Transient DOS when processing a malformed NR RRC configuration message due to improper input validation. | ||||
| CVE-2026-123011 | 2026-11-05 | 4.2 Medium | ||
| STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded. | ||||
| CVE-2026-123014 | 1 Iterm2 | 1 Iterm2 | 2026-11-05 | N/A |
| iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321. | ||||
| CVE-2026-85351 | 2026-11-05 | N/A | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type. | ||||
| CVE-2026-85346 | 2026-11-05 | N/A | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts. | ||||
| CVE-2026-16304 | 2026-11-05 | N/A | ||
| The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled. | ||||
| CVE-2026-123010 | 2026-11-05 | 7.2 High | ||
| @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set. | ||||
| CVE-2026-90628 | 1 Apache | 1 Openoffice | 2026-11-05 | 7.3 High |
| An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17, which fixes this issue. | ||||
| CVE-2026-121189 | 1 Google | 1 Chrome | 2026-11-05 | 9.6 Critical |
| Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121184 | 1 Google | 1 Chrome | 2026-11-05 | 8.8 High |
| Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-83596 | 1 Redhat | 7 Enterprise Linux, Rhel Aus, Rhel E4s and 4 more | 2026-11-05 | 8.8 High |
| A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | ||||
| CVE-2026-78376 | 1 Redhat | 7 Enterprise Linux, Rhel Aus, Rhel E4s and 4 more | 2026-11-05 | 8.8 High |
| A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. | ||||
| CVE-2026-93903 | 1 Litespeedtech | 1 Litespeed Web Server | 2026-11-05 | N/A |
| LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account. | ||||
| CVE-2026-116617 | 2026-11-05 | 8.1 High | ||
| The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or plugin PHP files, cannot be reached. | ||||
| CVE-2026-48176 | 2026-11-05 | N/A | ||
| A memory corruption vulnerability caused by improper validation of messages | ||||
| CVE-2026-33969 | 2026-11-05 | N/A | ||
| In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service. | ||||
| CVE-2026-69006 | 2026-11-05 | N/A | ||
| Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption. | ||||
| CVE-2026-69005 | 2026-11-05 | N/A | ||
| Integer overflow in NPU driver parameter processing due to insufficient bounds checking. | ||||