Export limit exceeded: 387228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (387228 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-20511 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 6.7 Medium |
| In SurfaceFlinger, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11123860; Issue ID: MSV-8890. | ||||
| CVE-2026-20509 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 6.7 Medium |
| In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11165543; Issue ID: MSV-9011. | ||||
| CVE-2026-20508 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 6.7 Medium |
| In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11165543; Issue ID: MSV-9012. | ||||
| CVE-2026-20507 | 1 Mediatek | 1 Mediatek Chipset | 2026-09-07 | 6.7 Medium |
| In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11191981; Issue ID: MSV-9125. | ||||
| CVE-2026-20506 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 6.7 Medium |
| In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11191981; Issue ID: MSV-9126. | ||||
| CVE-2026-20503 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 5.3 Medium |
| In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01371002; Issue ID: MSV-9020. | ||||
| CVE-2026-20502 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 8.4 High |
| In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9196. | ||||
| CVE-2026-20501 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-09-07 | 8.4 High |
| In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9197. | ||||
| CVE-2026-20500 | 1 Mediatek | 1 Mediatek Chipset | 2026-09-07 | 5.5 Medium |
| In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01810811; Issue ID: MSV-9232. | ||||
| CVE-2026-86299 | 1 Linksys | 1 Re7000 Firmware | 2026-09-07 | 9.9 Critical |
| A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-86298 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-09-07 | 7.3 High |
| A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-77697 | 1 Zohocorp | 1 Manageengine Endpoint Central | 2026-09-07 | 6.3 Medium |
| Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction | ||||
| CVE-2026-86297 | 1 D-link | 1 Dir-605 | 2026-09-07 | 8.1 High |
| A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used. | ||||
| CVE-2025-52657 | 2026-09-07 | 3.5 Low | ||
| HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability. | ||||
| CVE-2025-52652 | 2026-09-07 | 3.5 Low | ||
| HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft. | ||||
| CVE-2025-52651 | 2026-09-07 | 3.5 Low | ||
| HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues. | ||||
| CVE-2026-86296 | 1 D-link | 1 Dir-822a | 2026-09-07 | 10 Critical |
| A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-86332 | 1 Redhat | 1 Openshift Ai | 2026-09-07 | 6.5 Medium |
| A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy). | ||||
| CVE-2026-86295 | 1 D-link | 1 Dir-895l | 2026-09-07 | 8.3 High |
| A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-85201 | 2026-09-07 | N/A | ||
| In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded memory allocation that may abort the Ankaios agent process. This results in loss of orchestration services for workloads managed by the affected agent. | ||||