Export limit exceeded: 416731 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416731 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116657 | 1 Tanium | 1 Enforce | 2026-10-27 | 5.3 Medium |
| Tanium addressed a denial of service vulnerability in Enforce. | ||||
| CVE-2026-57198 | 1 Asterisk | 2 Asterisk, Certified Asterisk | 2026-10-27 | N/A |
| Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there. | ||||
| CVE-2026-57201 | 1 Asterisk | 2 Asterisk, Certified Asterisk | 2026-10-27 | 7.5 High |
| Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | ||||
| CVE-2026-16491 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-10-27 | 6.5 Medium |
| Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope. | ||||
| CVE-2026-118131 | 1 Gnupg | 1 Gnupg | 2026-10-27 | N/A |
| GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user. | ||||
| CVE-2026-116662 | 1 Tanium | 1 Enforce | 2026-10-27 | 7.5 High |
| Tanium addressed a compression bomb vulnerability in Enforce. | ||||
| CVE-2026-116660 | 1 Tanium | 1 Enforce | 2026-10-27 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Enforce. | ||||
| CVE-2026-116647 | 1 Tanium | 1 Comply | 2026-10-27 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Comply. | ||||
| CVE-2026-116649 | 1 Tanium | 1 Enforce | 2026-10-27 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Enforce. | ||||
| CVE-2026-116658 | 1 Tanium | 1 Enforce | 2026-10-27 | 6.5 Medium |
| Tanium addressed a denial of service vulnerability in Enforce. | ||||
| CVE-2026-117880 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117897 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-92374 | 1 Teamviewer | 2 Full Client, Host | 2026-10-27 | 7.8 High |
| A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root. | ||||
| CVE-2026-111583 | 1 Teamviewer | 2 Full Client, Host | 2026-10-27 | 7.3 High |
| Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation. | ||||
| CVE-2026-77172 | 1 Nextcloud | 1 Server | 2026-10-27 | N/A |
| App passwords were allowed to bypass password confirmation on sensitive endpoints. | ||||
| CVE-2026-67400 | 1 Nextcloud | 1 Richdocuments | 2026-10-27 | N/A |
| A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. | ||||
| CVE-2026-77167 | 1 Nextcloud | 1 Server | 2026-10-27 | N/A |
| Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database. | ||||
| CVE-2026-116659 | 1 Tanium | 1 Enforce | 2026-10-27 | 4.3 Medium |
| Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | ||||
| CVE-2026-116656 | 1 Tanium | 1 Enforce | 2026-10-27 | 7.5 High |
| Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | ||||
| CVE-2026-118132 | 1 Nextchat | 1 Nextchat | 2026-10-27 | N/A |
| NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application. | ||||