Export limit exceeded: 12724 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12724 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117992 | 1 Mozilla | 1 Firefox | 2026-11-05 | 6.5 Medium |
| Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-121254 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121243 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121239 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-110777 | 3 Gnome, Red Hat, Redhat | 4 Evolution-data-server, Enterprise Linux, Enterprise Linux and 1 more | 2026-11-05 | 5.7 Medium |
| A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events. | ||||
| CVE-2026-121059 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-120310 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-05 | 3.1 Low |
| Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field. | ||||
| CVE-2026-120233 | 1 Ag-ui-protocol | 1 Ag-ui | 2026-11-05 | 5.3 Medium |
| A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-121235 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121105 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121125 | 1 Google | 1 Chrome | 2026-11-05 | 5.3 Medium |
| Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121132 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121158 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121161 | 1 Google | 1 Chrome | 2026-11-05 | 6.5 Medium |
| Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-123061 | 1 Berriai | 1 Litellm | 2026-11-05 | 9.8 Critical |
| A critical vulnerability was discovered in LiteLLM Enterprise proxy where an unauthenticated remote attacker can trigger an arbitrary file read on any LLM route. This flaw allows an attacker to leak the proxy's master key (LITELLM_MASTER_KEY) and third-party model provider API credentials. With administrative proxy access obtained via the leaked master key, attackers can, in certain configurations, achieve remote code execution as root. | ||||
| CVE-2025-60892 | 2 Microsoft, Raspberrypi | 2 Windows, Imager | 2026-11-05 | 6.8 Medium |
| An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintentionally re-adds a user's id_rsa.pub key from their local Windows machine to the authorized_keys file on the Raspberry Pi, even after the user explicitly deletes the key from the user interface. This creates an unintended attack surface, as it could allow an attacker to use a different key than the intended one to login to the device. | ||||
| CVE-2025-49177 | 1 Redhat | 3 Enterprise Linux, Rhel Els, Rhel Eus | 2026-11-04 | 6.1 Medium |
| A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests. | ||||
| CVE-2024-4467 | 1 Redhat | 8 Advanced Virtualization, Container Native Virtualization, Enterprise Linux and 5 more | 2026-11-04 | 7.8 High |
| A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file. | ||||
| CVE-2026-117928 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.1 High |
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116819 | 1 Openpanel | 1 Openpanel | 2026-11-04 | 8.5 High |
| OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems. | ||||