Export limit exceeded: 425898 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425898 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58963 | 1 Google | 1 Android | 2026-11-15 | 7.5 High |
| In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-59001 | 1 Google | 1 Android | 2026-11-15 | 4 Medium |
| In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58930 | 1 Google | 1 Android | 2026-11-15 | 7.8 High |
| An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element. | ||||
| CVE-2026-106716 | 2026-11-15 | 6.5 Medium | ||
| ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload. | ||||
| CVE-2026-48176 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-15 | 7.5 High |
| A memory corruption vulnerability caused by improper validation of messages | ||||
| CVE-2026-33958 | 1 Samsung Semiconductor | 15 Exynos 1080, Exynos 1280, Exynos 1330 and 12 more | 2026-11-15 | 7.5 High |
| Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition. | ||||
| CVE-2025-66367 | 1 Samsung Semiconductor | 18 Exynos 1280, Exynos 1330, Exynos 1380 and 15 more | 2026-11-15 | 7.5 High |
| Improper handling of NAS DLTransport messages may lead to a baseband crash. | ||||
| CVE-2026-33965 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-15 | 5.3 Medium |
| An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow. | ||||
| CVE-2026-69066 | 1 Samsung Semiconductor | 5 Exynos 1480, Exynos 1580, Exynos 2200 and 2 more | 2026-11-15 | 8.4 High |
| Memory corruption in GPU driver due to improper validation of VMID reservation. | ||||
| CVE-2026-69002 | 1 Samsung Semiconductor | 4 Exynos 1580, Exynos 1680, Exynos 2500 and 1 more | 2026-11-15 | 7.5 High |
| Incorrect authorization in Samsung framework services due to missing permission checks | ||||
| CVE-2026-68991 | 1 Samsung Semiconductor | 2 Exynos 1480, Exynos 2400 | 2026-11-15 | 9.8 Critical |
| In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition. | ||||
| CVE-2026-69025 | 1 Samsung Semiconductor | 2 Exynos 1480, Exynos 2400 | 2026-11-15 | 7.5 High |
| In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service | ||||
| CVE-2026-48174 | 1 Samsung Semiconductor | 9 Exynos 1280, Exynos 1330, Exynos 1380 and 6 more | 2026-11-15 | 9.8 Critical |
| In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition. | ||||
| CVE-2026-121821 | 1 Ly Corporation | 1 Armeria | 2026-11-15 | N/A |
| A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials. | ||||
| CVE-2026-129349 | 2026-11-15 | N/A | ||
| When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password. A cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default in DefaultLdapRealm accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user. This issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm (or JndiLdapRealm) with authenticationCachingEnabled set to true, which is not the default. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher by default. Alternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info. | ||||
| CVE-2026-11749 | 1 Ly Corporation | 1 Armeria | 2026-11-15 | N/A |
| A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period. | ||||
| CVE-2025-66365 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-15 | 5.3 Medium |
| Incorrect handling of SIP packets leads to baseband crashes | ||||
| CVE-2026-35495 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-15 | 6.5 Medium |
| In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability | ||||
| CVE-2026-48179 | 1 Samsung Semiconductor | 5 Exynos 1080, Exynos 9110, Exynos Modem 5123 and 2 more | 2026-11-15 | 7.5 High |
| In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service | ||||
| CVE-2026-113961 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-15 | 7.5 High |
| An authorization issue was addressed with improved validation. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages. | ||||