Search

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (420515 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-79872 1 Hpe 1 Aos 2026-11-02 9.4 Critical
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVE-2026-79885 1 Hpe 1 Aos 2026-11-02 8.2 High
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.
CVE-2026-20555 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876664; Issue ID: MSV-9834.
CVE-2026-20561 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01750090; Issue ID: MSV-8908.
CVE-2026-20563 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01777997; Issue ID: MSV-8905.
CVE-2026-20578 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846.
CVE-2026-20593 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503.
CVE-2026-20594 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364.
CVE-2026-20597 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909.
CVE-2026-20600 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924.
CVE-2026-68588 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920.
CVE-2026-68591 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 6.7 Medium
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.
CVE-2026-113951 1 Apple 1 Container 2026-11-02 7.8 High
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.
CVE-2026-20560 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870543; Issue ID: MSV-9070.
CVE-2026-20596 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910.
CVE-2026-20599 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 6.7 Medium
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.
CVE-2026-68589 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 6.7 Medium
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889.
CVE-2026-68590 2 Mediatek, Mediatek, Inc. 2 Mediatek Chipset, Mediatek Chipset 2026-11-02 5.3 Medium
In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152.
CVE-2026-115785 2 Synacor, Zimbra 2 Zimbra Collaboration Suite, Zimbra Collaboration Suite 2026-11-02 4.3 Medium
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
CVE-2026-12617 1 Isc 2 Bind, Bind 9 2026-11-02 7.5 High
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.