Export limit exceeded: 24495 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24495 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68985 | 1 Samsung Semiconductor | 3 Exynos 1280, Exynos 1380, Exynos 2200 | 2026-11-10 | 7.5 High |
| In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service. | ||||
| CVE-2026-35494 | 1 Samsung Semiconductor | 9 Exynos 1280, Exynos 1330, Exynos 1380 and 6 more | 2026-11-10 | 7.5 High |
| In the baseband, memory corruption during NAS packet processing can cause a denial of service. | ||||
| CVE-2026-123025 | 1 Opnsense | 1 Os-acme-client | 2026-11-10 | N/A |
| An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root. | ||||
| CVE-2026-9669 | 1 Python | 1 Cpython | 2026-11-10 | 5.9 Medium |
| bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | ||||
| CVE-2026-124747 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-10 | 7.5 High |
| A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to execute arbitrary code or crash the application, resulting in a denial of service (DoS). | ||||
| CVE-2026-0320 | 1 Palo Alto Networks | 3 Cloud Ngfw, Pan-os, Prisma Access | 2026-11-10 | N/A |
| A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability. | ||||
| CVE-2025-15467 | 1 Openssl | 1 Openssl | 2026-11-10 | 8.8 High |
| Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. | ||||
| CVE-2023-52355 | 2 Libtiff, Redhat | 8 Libtiff, Ai Inference Server, Discovery and 5 more | 2026-11-10 | 7.5 High |
| An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB. | ||||
| CVE-2026-125742 | 1 7-zip | 1 7-zip | 2026-11-10 | 7.8 High |
| 7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution. | ||||
| CVE-2026-123717 | 2026-11-10 | N/A | ||
| OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run. | ||||
| CVE-2026-10834 | 1 Wordpress-extensions | 1 Wp Travel Engine | 2026-11-10 | 4.6 Medium |
| The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site. | ||||
| CVE-2026-63496 | 1 Electrovir | 1 Augment-vir | 2026-11-10 | 7.8 High |
| augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep() function exported by @augment-vir/node inserts caller-controlled search patterns directly into a double-quoted shell command string without sanitization (grep.ts:310). When the constructed command is passed to spawn() with shell: 'bash' (shell.ts:98-99), bash evaluates $() command substitution expressions embedded in the pattern, resulting in arbitrary OS command execution as the Node.js process user. Any downstream application that passes untrusted input to grep()'s pattern or patterns field is vulnerable to unauthenticated local (and potentially remote) code execution. This issue has been patched in version 31.73.5. | ||||
| CVE-2026-107240 | 1 Versa | 1 Vos | 2026-11-10 | N/A |
| The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled. | ||||
| CVE-2026-33374 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-10 | 6.5 Medium |
| The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions. | ||||
| CVE-2026-70197 | 1 Microsoft | 19 .net, .net 10.0 Installed On Linux, .net 10.0 Installed On Mac Os and 16 more | 2026-11-10 | 8.1 High |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96224 | 1 Microsoft | 5 .net, .net Framework, Microsoft Visual Studio 2022 Version 17.14 and 2 more | 2026-11-10 | 8.8 High |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70007 | 1 Microsoft | 5 .net, .net Framework, Microsoft Visual Studio 2022 Version 17.14 and 2 more | 2026-11-10 | 8.8 High |
| Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70388 | 1 Rt-labs Ab | 1 Soem | 2026-11-10 | 8.3 High |
| SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system. | ||||
| CVE-2026-111487 | 1 Qt | 3 Qt, Qt3d, Qt Framework | 2026-11-10 | 7.8 High |
| An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. | ||||
| CVE-2026-60039 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.2 High |
| A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability. | ||||