Export limit exceeded: 420602 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420602 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-101453 | 1 Oracle | 2 Siebel Crm, Siebel Crm Deployment | 2026-11-05 | 6.7 Medium |
| Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-58857 | 1 Google | 1 Android | 2026-11-05 | 8.1 High |
| In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-4647 | 2 Gnu, Redhat | 6 Binutils, Enterprise Linux, Hummingbird and 3 more | 2026-11-05 | 6.1 Medium |
| A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks. | ||||
| CVE-2026-117996 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-115828 | 1 Delinea | 1 Secret Server | 2026-11-05 | N/A |
| In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device | ||||
| CVE-2026-59048 | 1 Google | 1 Android | 2026-11-05 | 5.5 Medium |
| In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-121963 | 1 Freerdp | 1 Freerdp | 2026-11-05 | 5.9 Medium |
| FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client. | ||||
| CVE-2026-61649 | 1 Suitecrm | 1 Suitecrm | 2026-11-05 | 7.7 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-69137 | 1 Suitecrm | 1 Suitecrm | 2026-11-05 | 7.7 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-100364 | 1 Suitecrm | 1 Suitecrm | 2026-11-05 | 7.1 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-123273 | 1 Imagemagick | 1 Imagemagick | 2026-11-05 | 6.5 Medium |
| ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker. | ||||
| CVE-2026-112441 | 1 Apple | 1 Macos | 2026-11-05 | 3.3 Low |
| This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-112442 | 1 Apple | 1 Macos | 2026-11-05 | 4.7 Medium |
| A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system. | ||||
| CVE-2026-116668 | 1 Tanium | 1 Discover | 2026-11-05 | 4.3 Medium |
| Tanium addressed an uncontrolled resource consumption vulnerability in Discover. | ||||
| CVE-2026-116666 | 1 Tanium | 1 Discover | 2026-11-05 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Discover. | ||||
| CVE-2026-116664 | 1 Tanium | 1 Discover | 2026-11-05 | 3.1 Low |
| Tanium addressed an improper access controls vulnerability in Discover. | ||||
| CVE-2026-116669 | 1 Tanium | 1 Discover | 2026-11-05 | 6.5 Medium |
| Tanium addressed an improper access controls vulnerability in Discover. | ||||
| CVE-2026-116667 | 1 Tanium | 1 Discover | 2026-11-05 | 4.2 Medium |
| Tanium addressed an improper access controls vulnerability in Discover. | ||||
| CVE-2026-116665 | 1 Tanium | 1 Discover | 2026-11-05 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Discover. | ||||
| CVE-2026-116648 | 1 Tanium | 1 Discover | 2026-11-05 | 4.1 Medium |
| Tanium addressed an improper output sanitization vulnerability in Discover. | ||||