Export limit exceeded: 418969 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418975 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-99069 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-03 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b ("Input: ati-remote2 - use driver core to instantiate device attributes") converted the driver to let the driver core manage them via dev_groups in struct usb_driver, the attributes moved to the bound usb_interface devices, but the show and store callbacks were not updated accordingly. As a result, the callbacks still invoked to_usb_device() on a device pointer belonging to a struct usb_interface, producing an invalid usb_device pointer. Use to_usb_interface() directly in the attribute handlers to obtain the interface and its driver data. | ||||
| CVE-2026-118025 | 1 Mozilla | 1 Firefox | 2026-11-03 | 6.1 Medium |
| Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-99076 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-03 | 3.7 Low |
| In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the exception cache in order to discover the ephemeral port used by a connected UDP socket. Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and commit a00df2caffed ("ipv6: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the exception cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating an exception, even before trying to find a matching socket. Do that by calling ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in an exception being created or updated in the cache that the attacker can observe. Pass the ifindex of the ingress device and the default uid, in a similar fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any nexthop in ip6_redirect_nh_match() and no exception would be created in response to a Redirect Message. Note that this does not allow attackers to create exceptions that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMPv6 error that quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ip6_sk_update_pmtu() / ip6_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the exception cache of the nexthop resolved by the no socket helpers and another in the exception cache of the nexthop used by the socket. | ||||
| CVE-2026-118011 | 1 Mozilla | 1 Firefox | 2026-11-03 | 7.5 High |
| Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118018 | 1 Mozilla | 1 Firefox | 2026-11-03 | 6.1 Medium |
| Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159. | ||||
| CVE-2026-6324 | 2 Gnome, Redhat | 2 Libsoup, Enterprise Linux | 2026-11-03 | 4.8 Medium |
| A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access. | ||||
| CVE-2026-99017 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-03 | 7 High |
| In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched. The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU. Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied. | ||||
| CVE-2026-118024 | 1 Mozilla | 1 Firefox | 2026-11-03 | 6.1 Medium |
| Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118026 | 1 Mozilla | 1 Firefox | 2026-11-03 | 3.4 Low |
| Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-28597 | 1 Google | 1 Android | 2026-11-03 | 8.4 High |
| In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49923 | 1 Google | 1 Android | 2026-11-03 | 8.4 High |
| In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-105476 | 1 Webpros | 1 Cpanel | 2026-11-03 | 8.8 High |
| Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges. | ||||
| CVE-2026-99072 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-03 | 4.7 Medium |
| In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path. | ||||
| CVE-2026-84599 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-03 | 4.4 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-118013 | 1 Mozilla | 1 Firefox | 2026-11-03 | 7.5 High |
| Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118014 | 1 Mozilla | 1 Firefox | 2026-11-03 | 7.5 High |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118016 | 1 Mozilla | 1 Firefox | 2026-11-03 | 7.5 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118017 | 1 Mozilla | 1 Firefox | 2026-11-03 | 7.5 High |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-28645 | 1 Google | 1 Android | 2026-11-03 | 6.8 Medium |
| In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58873 | 1 Google | 1 Android Xr | 2026-11-03 | 8.4 High |
| In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||