Export limit exceeded: 54328 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (54328 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93903 | 1 Litespeedtech | 1 Litespeed Web Server | 2026-11-05 | N/A |
| LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account. | ||||
| CVE-2026-48176 | 2026-11-05 | N/A | ||
| A memory corruption vulnerability caused by improper validation of messages | ||||
| CVE-2026-69005 | 2026-11-05 | N/A | ||
| Integer overflow in NPU driver parameter processing due to insufficient bounds checking. | ||||
| CVE-2025-66366 | 2026-11-05 | N/A | ||
| Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash | ||||
| CVE-2026-48173 | 2026-11-05 | N/A | ||
| In the NAS message handler, improper validation of the length field in NAS message causes memory corruption | ||||
| CVE-2026-122992 | 2026-11-05 | N/A | ||
| In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field. | ||||
| CVE-2026-48179 | 2026-11-05 | N/A | ||
| In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service | ||||
| CVE-2026-33958 | 2026-11-05 | N/A | ||
| Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition. | ||||
| CVE-2026-68984 | 2026-11-05 | N/A | ||
| In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption. | ||||
| CVE-2026-48175 | 2026-11-05 | N/A | ||
| Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. | ||||
| CVE-2025-66367 | 2026-11-05 | N/A | ||
| Improper handling of NAS DLTransport messages may lead to a baseband crash. | ||||
| CVE-2026-63402 | 1 I18next | 1 I18next | 2026-11-05 | 5.9 Medium |
| i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4. | ||||
| CVE-2026-63121 | 1 Kubewarden | 1 Policies | 2026-11-05 | 6.3 Medium |
| Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2. | ||||
| CVE-2026-119340 | 1 Tesseract-ocr | 1 Tesseract Ocr | 2026-11-05 | 5.5 Medium |
| Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service. This issue is fixed in version 5.5.4. | ||||
| CVE-2026-119338 | 1 Tesseract-ocr | 1 Tesseract Ocr | 2026-11-05 | 6.6 Medium |
| Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline. This issue is fixed in version 5.5.4. | ||||
| CVE-2026-122189 | 1 Openppl | 1 Ppl.nn | 2026-11-05 | 6.3 Medium |
| A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-33972 | 2026-11-05 | N/A | ||
| In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation. | ||||
| CVE-2026-99236 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-05 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations. | ||||
| CVE-2026-122146 | 1 101arrowz | 1 Fflate | 2026-11-05 | 7.3 High |
| A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-62365 | 1 Wazuh | 1 Wazuh | 2026-11-05 | 5.3 Medium |
| Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7. | ||||