Export limit exceeded: 54436 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (54436 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118603 | 1 Alpine | 1 Ilx-f511 | 2026-11-05 | N/A |
| Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29017. | ||||
| CVE-2026-116841 | 1 Diasurgical | 1 Devilutionx | 2026-11-05 | 5.5 Medium |
| DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game. | ||||
| CVE-2026-117977 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117978 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.1 High |
| Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117979 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-112451 | 1 Apple | 1 Macos | 2026-11-05 | 8.2 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service or disclose process memory. | ||||
| CVE-2026-112454 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-11-05 | 8.2 High |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory. | ||||
| CVE-2026-112495 | 1 Apple | 1 Macos | 2026-11-05 | 7.1 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-85287 | 1 Sysadminsmedia | 1 Homebox | 2026-11-05 | 6.5 Medium |
| HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0. | ||||
| CVE-2026-123125 | 1 Sensiolabs | 1 Symfony | 2026-11-05 | 6.5 Medium |
| The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. In these modes, IpValidator relies on the PHP flags FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to classify addresses as public, private, or reserved. These flags do not cover shared address space (100.64.0.0/10) or IPv4-mapped, IPv4-compatible, and 6to4 IPv6 addresses, which can embed internal IPv4 addresses. A value such as ::ffff:127.0.0.1 can therefore pass validation even though it points to an internal host. Applications that rely on the Ip constraint to reject internal addresses, for example before making a server-side request to a user-supplied address, can be exposed to SSRF. | ||||
| CVE-2026-48175 | 2026-11-05 | 5.5 Medium | ||
| Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. | ||||
| CVE-2026-54140 | 1 Tinyhumansai | 1 Openhuman | 2026-11-05 | 8.3 High |
| OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13. | ||||
| CVE-2026-82910 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-05 | 8.8 High |
| Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-12548 | 3 Gnome, Libsoup, Redhat | 3 Libsoup, Libsoup, Enterprise Linux | 2026-11-05 | 4.2 Medium |
| A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents. | ||||
| CVE-2026-122006 | 1 Rubyonrails | 1 Active Storage | 2026-11-05 | 9.8 Critical |
| The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality. | ||||
| CVE-2026-120336 | 1 Vstarcam | 1 O-kam Client | 2026-11-05 | 7.3 High |
| A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-118611 | 1 Alpine | 1 Ilx-f511 | 2026-11-05 | N/A |
| Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth OBEX packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29012. | ||||
| CVE-2026-118610 | 1 Alpine | 1 Ilx-f511 | 2026-11-05 | N/A |
| Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29015. | ||||
| CVE-2026-118609 | 1 Alpine | 1 Ilx-f511 | 2026-11-05 | N/A |
| Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto connection handler. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29016. | ||||
| CVE-2026-118608 | 1 Alpine | 1 Ilx-f511 | 2026-11-05 | N/A |
| Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the prh_rfcomm_cc_process_test function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-29018. | ||||