Export limit exceeded: 394849 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (394849 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91712 | 2 Apple, Google | 2 Macos, Chrome | 2026-09-17 | 8.3 High |
| Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-91711 | 1 Google | 1 Chrome | 2026-09-17 | 8.8 High |
| Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-91710 | 1 Google | 1 Chrome | 2026-09-17 | 9.6 Critical |
| Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-91709 | 1 Google | 1 Chrome | 2026-09-17 | 8.8 High |
| Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-91708 | 1 Google | 1 Chrome | 2026-09-17 | 3.1 Low |
| Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-43785 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-09-17 | 5.5 Medium |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to modify a file it only had permission to read. | ||||
| CVE-2026-89418 | 2026-09-17 | N/A | ||
| google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required. | ||||
| CVE-2026-14850 | 1 Mobiapparc | 1 Mobiapparc | 2026-09-17 | N/A |
| The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership. | ||||
| CVE-2026-66572 | 2026-09-17 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. | ||||
| CVE-2026-66577 | 2026-09-17 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. | ||||
| CVE-2026-66579 | 2026-09-17 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions. | ||||
| CVE-2026-90887 | 2026-09-17 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions. | ||||
| CVE-2026-78528 | 2026-09-17 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. | ||||
| CVE-2026-78294 | 2026-09-17 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. | ||||
| CVE-2026-74005 | 2026-09-17 | 5.4 Medium | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. | ||||
| CVE-2026-74002 | 2026-09-17 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. | ||||
| CVE-2026-73999 | 2026-09-17 | 5.4 Medium | ||
| Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. | ||||
| CVE-2026-66631 | 2026-09-17 | 7.6 High | ||
| Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. | ||||
| CVE-2026-66630 | 2026-09-17 | 7.6 High | ||
| Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. | ||||
| CVE-2026-66626 | 2026-09-17 | 7.6 High | ||
| Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. | ||||