Export limit exceeded: 400456 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400456 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400456 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95274 | 1 Google | 1 Chrome | 2026-09-30 | 8.3 High |
| Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-48864 | 2 Opensuse, Redhat | 23 Libsolv, Cert Manager, Discovery and 20 more | 2026-09-30 | 7.8 High |
| A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service. | ||||
| CVE-2026-15588 | 1 Redhat | 17 Ai Inference Server, Cert Manager, Discovery and 14 more | 2026-09-30 | 5.3 Medium |
| A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang. | ||||
| CVE-2026-14164 | 3 Libarchive, Red Hat, Redhat | 14 Libarchive, Enterprise Linux, Cert Manager and 11 more | 2026-09-30 | 7.5 High |
| A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service. | ||||
| CVE-2023-52355 | 2 Libtiff, Redhat | 7 Libtiff, Ai Inference Server, Discovery and 4 more | 2026-09-30 | 7.5 High |
| An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB. | ||||
| CVE-2026-95276 | 1 Google | 1 Chrome | 2026-09-30 | 8.3 High |
| Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-95277 | 1 Google | 1 Chrome | 2026-09-30 | 9.6 Critical |
| Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102306 | 1 Google | 1 Chrome | 2026-09-30 | 9.6 Critical |
| Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95280 | 1 Google | 1 Chrome | 2026-09-30 | 7.5 High |
| Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95286 | 1 Google | 1 Chrome | 2026-09-30 | 8.8 High |
| Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102454 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 7.2 High |
| EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. | ||||
| CVE-2026-102456 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 6.5 Medium |
| EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents. | ||||
| CVE-2026-102458 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 9.8 Critical |
| EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API. | ||||
| CVE-2026-102455 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 9.8 Critical |
| EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content. | ||||
| CVE-2026-102457 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 6.5 Medium |
| EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. | ||||
| CVE-2026-95288 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-30 | 5.4 Medium |
| UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-95289 | 1 Google | 1 Chrome | 2026-09-30 | 4.3 Medium |
| Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95282 | 1 Google | 1 Chrome | 2026-09-30 | 8.8 High |
| Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95291 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-30 | 5.4 Medium |
| UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102623 | 2 Kubevirt, Redhat | 2 Kubevirt, Container Native Virtualization | 2026-09-30 | 6.5 Medium |
| A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment. | ||||