Export limit exceeded: 420337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420337 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420337 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59022 | 1 Google | 1 Android | 2026-11-05 | 5.5 Medium |
| In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-110930 | 2026-11-05 | 8.0 High | ||
| Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval. | ||||
| CVE-2026-73585 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-05 | 6.3 Medium |
| A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections. | ||||
| CVE-2026-73584 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-05 | 6.3 Medium |
| A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system. | ||||
| CVE-2026-73583 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-05 | 6.6 Medium |
| A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure. | ||||
| CVE-2026-113663 | 2026-11-05 | 8.8 High | ||
| AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1. | ||||
| CVE-2026-71224 | 1 Redhat | 3 Enterprise Linux, Gfs2-utils, Rhel Els | 2026-11-05 | 4.7 Medium |
| A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images. | ||||
| CVE-2026-71222 | 1 Redhat | 3 Enterprise Linux, Gfs2-utils, Rhel Els | 2026-11-05 | 5.3 Medium |
| A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images. | ||||
| CVE-2026-71221 | 1 Redhat | 3 Enterprise Linux, Gfs2-utils, Rhel Els | 2026-11-05 | 7 High |
| A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images. | ||||
| CVE-2026-71220 | 1 Redhat | 3 Enterprise Linux, Gfs2-utils, Rhel Els | 2026-11-05 | 7 High |
| A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images. | ||||
| CVE-2026-71219 | 1 Redhat | 3 Enterprise Linux, Gfs2-utils, Rhel Els | 2026-11-05 | 4.7 Medium |
| A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta. | ||||
| CVE-2026-71218 | 2 Iperf3 Project, Redhat | 3 Iperf3, Enterprise Linux, Rhel Els | 2026-11-05 | 5.3 Medium |
| A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service. | ||||
| CVE-2026-70368 | 2 Redhat, Stunnel | 3 Enterprise Linux, Rhel Els, Stunnel | 2026-11-05 | 6.5 Medium |
| A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0". | ||||
| CVE-2026-70367 | 2 Redhat, Stunnel | 3 Enterprise Linux, Rhel Els, Stunnel | 2026-11-05 | 5.4 Medium |
| A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable. | ||||
| CVE-2026-68742 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. | ||||
| CVE-2026-68743 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. | ||||
| CVE-2026-6862 | 2 Redhat, Ubuntu | 6 Enterprise Linux, Hummingbird, Openshift and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS). | ||||
| CVE-2026-6861 | 2 Gnu, Redhat | 4 Emacs, Emacs, Enterprise Linux and 1 more | 2026-11-05 | 6.1 Medium |
| A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS (Cascading Style Sheets) data. A local user could exploit this by convincing a victim to open a malicious SVG file, which may lead to a denial of service (DoS) or potentially information disclosure. | ||||
| CVE-2026-6843 | 2 Gnu, Redhat | 6 Nano, Enterprise Linux, Nano and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application. | ||||
| CVE-2026-102943 | 2026-11-05 | 6.5 Medium | ||
| Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP dagu_read operation with target dag_spec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read .yaml or .yml files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0. | ||||