Export limit exceeded: 424258 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424258 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65525 | 2 Uxper, Wordpress | 2 Civi Framework, Wordpress | 2026-10-24 | 5.3 Medium |
| Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | ||||
| CVE-2026-59528 | 2 Shiptime, Wordpress | 2 Shiptime: Discounted Shipping Rates, Wordpress | 2026-10-24 | 7.5 High |
| Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. | ||||
| CVE-2026-65485 | 2 Daniel Iser, Wordpress | 2 Content Control, Wordpress | 2026-10-24 | 5.3 Medium |
| Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions. | ||||
| CVE-2026-65479 | 2 Mvp Themes, Wordpress | 2 Reviewer, Wordpress | 2026-10-24 | 5.4 Medium |
| Subscriber Broken Access Control in Reviewer <= 3.14.2 versions. | ||||
| CVE-2026-64704 | 1 Apple | 1 Macos | 2026-10-24 | 9.8 Critical |
| A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-64702 | 1 Apple | 1 Macos | 2026-10-24 | 9.8 Critical |
| An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox. | ||||
| CVE-2026-64697 | 1 Apple | 1 Macos | 2026-10-24 | 9.8 Critical |
| The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-63727 | 1 Anchore | 2 Anchore, Anchore Enterprise | 2026-10-24 | 8.8 High |
| Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1. | ||||
| CVE-2026-62200 | 1 Openclaw | 1 Openclaw | 2026-10-24 | 8.8 High |
| OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. | ||||
| CVE-2026-61947 | 2 Wordpress, Wpvibes | 2 Wordpress, Form Vibes – Database Manager For Forms | 2026-10-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions. | ||||
| CVE-2026-49745 | 3 Google, Imaginationtech, Linux | 4 Android, Ddk, Graphics Ddk and 1 more | 2026-10-24 | 7.8 High |
| Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges. | ||||
| CVE-2026-49743 | 3 Google, Imaginationtech, Linux | 4 Android, Ddk, Graphics Ddk and 1 more | 2026-10-24 | 7.8 High |
| Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition. | ||||
| CVE-2026-17734 | 1 Google | 1 Chrome | 2026-10-24 | 5.4 Medium |
| Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17724 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-24 | 4.2 Medium |
| Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17659 | 1 Google | 1 Chrome | 2026-10-24 | 4.2 Medium |
| Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17570 | 1 Devolutions | 2 Devolutions Server, Server | 2026-10-24 | 4.3 Medium |
| Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier | ||||
| CVE-2026-16802 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | 6.5 Medium |
| Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected. | ||||
| CVE-2026-16801 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | 8.8 High |
| Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file. | ||||
| CVE-2026-16799 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | 5 Medium |
| Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks. | ||||
| CVE-2026-43771 | 1 Apple | 1 Macos | 2026-10-24 | 7.1 High |
| A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service. | ||||