Export limit exceeded: 419220 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419220 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419220 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419220 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121728 | 2026-11-03 | 5.3 Medium | ||
| SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts. | ||||
| CVE-2026-121727 | 2026-11-03 | 7.5 High | ||
| Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory. | ||||
| CVE-2026-15343 | 1 Github | 1 Enterprise Server | 2026-11-03 | N/A |
| A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/, because path validation did not check the actual write destination. The initial fix in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18 was incomplete because validation checked the supplied symlink target, while the publisher wrote the file using its directory and name. Writing GitHub Actions workflow files required the Dependabot installation to have workflows: write permission. Depending on repository permissions and workflow configuration, including a relevant pull_request_target workflow or auto-merge, an injected workflow could execute with access to GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fully fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2026-121581 | 1 Arcreel | 1 Arcreel | 2026-11-03 | 4.3 Medium |
| A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-121102 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121099 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121125 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121175 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121141 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121042 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121134 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121138 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121055 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-121165 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121159 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121050 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121162 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121045 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121029 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-121142 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) | ||||