Export limit exceeded: 418975 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418975 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28853 | 1 Apple | 1 Macos | 2026-11-03 | 7.8 High |
| The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges. | ||||
| CVE-2026-112467 | 1 Apple | 1 Macos | 2026-11-03 | 3.3 Low |
| This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to bypass network restrictions. | ||||
| CVE-2026-121024 | 1 Axxonsoft | 1 Axxonnet | 2026-11-03 | 5.4 Medium |
| Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API. | ||||
| CVE-2026-121023 | 1 Axxonsoft | 1 Axxonnet Arp Agent | 2026-11-03 | 5.5 Medium |
| Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data. | ||||
| CVE-2026-121022 | 1 Axxonsoft | 1 Axxon One | 2026-11-03 | 8.1 High |
| Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login. | ||||
| CVE-2026-121021 | 1 Axxonsoft | 1 Axxon One | 2026-11-03 | 5.5 Medium |
| Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file. | ||||
| CVE-2026-112647 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-121020 | 1 Axxonsoft | 1 Axxon One | 2026-11-03 | 4.3 Medium |
| Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions. | ||||
| CVE-2026-120684 | 1 Mongodb | 1 C Driver | 2026-11-03 | 6.5 Medium |
| A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials. | ||||
| CVE-2026-120678 | 1 Mongodb | 1 C Driver | 2026-11-03 | 7.5 High |
| A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required. | ||||
| CVE-2026-120673 | 1 Mongodb | 1 Rust Driver | 2026-11-03 | 5.5 Medium |
| A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data. | ||||
| CVE-2026-119977 | 1 Wordpress Foundation | 1 Wordpress | 2026-11-03 | 8.1 High |
| WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | ||||
| CVE-2026-119922 | 1 Aws | 1 Babelfish-for-postgresql | 2026-11-03 | 8.8 High |
| Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. | ||||
| CVE-2026-116838 | 1 Ubiquiti | 1 Airmax M | 2026-11-03 | 8.8 High |
| A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device. | ||||
| CVE-2026-116837 | 1 Ubiquiti | 4 Airmax M, Ltu Ptmp, Ltu Ptp and 1 more | 2026-11-03 | 8.8 High |
| A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device. | ||||
| CVE-2026-116836 | 1 Ubiquiti | 1 Airmax M | 2026-11-03 | 8.8 High |
| A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device. | ||||
| CVE-2026-113945 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-112704 | 1 Apple | 1 Macos | 2026-11-03 | 6.5 Medium |
| An information leakage was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox. | ||||
| CVE-2026-112682 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-03 | 7.5 High |
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. A remote attacker may be able to cause unexpected app termination. | ||||
| CVE-2026-112568 | 1 Apple | 1 Macos | 2026-11-03 | 5.5 Medium |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may bypass Gatekeeper checks. | ||||