Export limit exceeded: 109137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109137 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-117915 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 7.3 High |
| Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117897 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117892 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117891 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117890 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116819 | 1 Openpanel | 1 Openpanel | 2026-11-04 | 8.5 High |
| OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems. | ||||
| CVE-2026-116245 | 1 Pgadmin | 1 Pgadmin 4 | 2026-11-04 | 8.2 High |
| libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as "service=..." as a connection string. The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string. This issue affects pgAdmin 4: before 9.19. | ||||
| CVE-2026-118175 | 1 Mozilla | 1 Thunderbird | 2026-11-04 | 7.5 High |
| When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | ||||
| CVE-2026-119776 | 1 Frrouting | 1 Frrouting | 2026-11-04 | 7.7 High |
| In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks. Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked. Required configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with "router ospf6" and on specific interfaces with "ipv6 ospf6 area".) Workaround: either: * configure OSPFv3 authentication trailers ("ipv6 ospf6 authentication") * or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses. | ||||
| CVE-2026-112470 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-04 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-113934 | 1 Apple | 1 Macos | 2026-11-04 | 7.8 High |
| The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-112477 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-04 | 7 High |
| A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-117867 | 1 Mozilla | 1 Firefox | 2026-11-04 | 7.3 High |
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116247 | 1 Pgadmin | 1 Pgadmin 4 | 2026-11-04 | 8.2 High |
| When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key, or PGPASSFILE, PGSSLCERT and PGSSLKEY. In server mode any user could therefore connect to a server with the service account's saved passwords or client certificate, and supplying only a copy of its public certificate was enough for libpq to pair it with the service account's private key. A pg_service.conf entry, or a maintenance database name read as a connection string by pg_dumpall, could bring the same files back for the utilities. The fix gives each of these parameters a value in server mode, the user's own file or otherwise a path that can never be opened, in the connection string, in the environment of the utilities and in the --dbname connection string that ranks above a service entry. Desktop mode is unchanged. This issue affects pgAdmin 4: before 9.19. | ||||
| CVE-2026-9212 | 1 Netgear | 47 Lbr1020, Lbr1020 Firmware, Lbr20 and 44 more | 2026-11-04 | 8.0 High |
| Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations. | ||||
| CVE-2026-87086 | 1 Tanium | 1 Provision | 2026-11-04 | 7.5 High |
| Tanium addressed a denial of service vulnerability in Provision. | ||||
| CVE-2026-117872 | 1 Mozilla | 1 Firefox | 2026-11-04 | 8.8 High |
| Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117860 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-04 | 8.1 High |
| Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116649 | 1 Tanium | 1 Enforce | 2026-11-04 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Enforce. | ||||
| CVE-2026-116647 | 1 Tanium | 1 Comply | 2026-11-04 | 7.1 High |
| Tanium addressed an improper output sanitization vulnerability in Comply. | ||||