Total
13726 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-58937 | 2026-11-03 | N/A | 6.2 MEDIUM | ||
| In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-58875 | 2026-11-03 | N/A | 6.2 MEDIUM | ||
| In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-58817 | 2026-11-03 | N/A | 6.2 MEDIUM | ||
| In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-55272 | 2026-11-03 | N/A | 6.2 MEDIUM | ||
| In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-28643 | 2026-11-03 | N/A | 6.2 MEDIUM | ||
| In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-121242 | 2026-11-03 | N/A | N/A | ||
| Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-121240 | 2026-11-03 | N/A | N/A | ||
| Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) | |||||
| CVE-2026-121115 | 2026-11-03 | N/A | N/A | ||
| Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-84547 | 1 Apple | 1 Macos | 2026-11-03 | N/A | 3.5 LOW |
| A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in physical proximity may be able to corrupt process memory. | |||||
| CVE-2026-86871 | 1 Apple | 1 Macos | 2026-11-03 | N/A | 5.9 MEDIUM |
| An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination. | |||||
| CVE-2026-121424 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser. | |||||
| CVE-2026-44265 | 2026-11-03 | N/A | 7.4 HIGH | ||
| Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1. | |||||
| CVE-2026-121425 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists. | |||||
| CVE-2026-119210 | 2026-11-03 | N/A | 5.9 MEDIUM | ||
| MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11. | |||||
| CVE-2026-121426 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content. | |||||
| CVE-2026-116768 | 2026-11-03 | N/A | N/A | ||
| CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time. | |||||
| CVE-2026-119641 | 2026-11-03 | N/A | N/A | ||
| ** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's workflow job and change its ownership. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2026-121407 | 1 Freerdp | 1 Freerdp | 2026-11-03 | N/A | 6.5 MEDIUM |
| FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions. | |||||
| CVE-2026-121411 | 1 Freerdp | 1 Freerdp | 2026-11-03 | N/A | 3.1 LOW |
| FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client. | |||||
| CVE-2026-121415 | 2026-11-03 | N/A | 3.7 LOW | ||
| Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields. | |||||