Export limit exceeded: 372040 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372040 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-60370 | 1 Oracle | 1 Platform Security For Java | 2026-07-27 | 7.5 High |
| Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-38764 | 2026-07-27 | 7.8 High | ||
| An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys | ||||
| CVE-2026-39155 | 1 Knot-dns | 1 Knot Dns | 2026-07-27 | 6.5 Medium |
| Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to synthesize negative answers for legitimate names and causing resolver-side denial of service. | ||||
| CVE-2026-63226 | 1 Ricoh Company | 1 Ricoh Printers And Multifunction Printers (mfps) | 2026-07-27 | N/A |
| Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN. | ||||
| CVE-2026-59676 | 1 Selinux Project | 1 Selinux | 2026-07-27 | 5.3 Medium |
| A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10. | ||||
| CVE-2026-52684 | 1 Powerdns | 1 Recursor | 2026-07-27 | 3.7 Low |
| If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records. | ||||
| CVE-2026-52686 | 1 Powerdns | 1 Recursor | 2026-07-27 | 3.7 Low |
| The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record. | ||||
| CVE-2026-64804 | 1 Jetbrains | 1 Webstorm | 2026-07-27 | 8.4 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling | ||||
| CVE-2026-64805 | 1 Jetbrains | 1 Webstorm | 2026-07-27 | 8.4 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling | ||||
| CVE-2026-64807 | 1 Jetbrains | 1 Webstorm | 2026-07-27 | 7.8 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration | ||||
| CVE-2026-64809 | 1 Jetbrains | 1 Phpstorm | 2026-07-27 | 8.4 High |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter | ||||
| CVE-2026-64811 | 1 Jetbrains | 1 Intellij Idea | 2026-07-27 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration | ||||
| CVE-2026-64814 | 1 Jetbrains | 1 Intellij Idea | 2026-07-27 | 8.6 High |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | ||||
| CVE-2026-16807 | 1 Google | 1 Chrome | 2026-07-27 | 8.8 High |
| Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-16805 | 1 Google | 1 Chrome | 2026-07-27 | 8.8 High |
| Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-66141 | 1 Exim | 1 Exim | 2026-07-27 | 7.4 High |
| Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled. | ||||
| CVE-2026-16798 | 1 Devolutions | 1 Powershell Universal | 2026-07-27 | 6.5 Medium |
| Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token. | ||||
| CVE-2026-64208 | 1 Linux | 1 Linux Kernel | 2026-07-27 | 7.5 High |
| In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AF_RXRPC to make use of this to validate DATA packets secured with RxGK. | ||||
| CVE-2026-64222 | 1 Linux | 1 Linux Kernel | 2026-07-27 | 7 High |
| In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. Set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware. | ||||
| CVE-2026-64225 | 1 Linux | 1 Linux Kernel | 2026-07-27 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range. | ||||