Export limit exceeded: 400214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400214 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-100793 | 1 Mozilla | 1 Firefox | 2026-10-01 | N/A |
| JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-100794 | 1 Mozilla | 1 Firefox | 2026-10-01 | N/A |
| Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | ||||
| CVE-2026-76724 | 1 Hewlett Packard Enterprise (hpe) | 1 Instant On | 2026-10-01 | 9.6 Critical |
| A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-76725 | 1 Hewlett Packard Enterprise (hpe) | 1 Instant On | 2026-10-01 | 9.6 Critical |
| A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges. | ||||
| CVE-2026-47498 | 1 Nvidia | 1 Virtual Gpu Manager | 2026-10-01 | 7.8 High |
| NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | ||||
| CVE-2026-100803 | 1 Mozilla | 1 Firefox | 2026-10-01 | N/A |
| Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-100822 | 1 Mozilla | 1 Firefox | 2026-10-01 | 5.4 Medium |
| Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | ||||
| CVE-2026-95358 | 1 Google | 1 Chrome | 2026-10-01 | 4.4 Medium |
| Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium) | ||||
| CVE-2026-102728 | 1 Eclipse | 1 Netx Duo | 2026-10-01 | 7.5 High |
| Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard. | ||||
| CVE-2026-103270 | 1 Modeltc | 1 Lightllm | 2026-10-01 | 7.5 High |
| LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl. | ||||
| CVE-2026-100262 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 7.6 High |
| In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates | ||||
| CVE-2026-100263 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 4.7 Medium |
| In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible | ||||
| CVE-2026-100265 | 1 Jetbrains | 1 Rider | 2026-10-01 | 4.8 Medium |
| In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation | ||||
| CVE-2026-100266 | 1 Jetbrains | 1 Hub | 2026-10-01 | 7.7 High |
| In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address | ||||
| CVE-2026-100267 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 5.9 Medium |
| In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters | ||||
| CVE-2026-100268 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 7.7 High |
| In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | ||||
| CVE-2026-100276 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 5.9 Medium |
| In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action | ||||
| CVE-2026-100277 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 8.9 High |
| In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature | ||||
| CVE-2026-100278 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 4.9 Medium |
| In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments | ||||
| CVE-2026-100280 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible | ||||