Total
8761 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-116282 | 2026-10-26 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-116281 | 2026-10-26 | 1.7 LOW | 3.3 LOW | ||
| A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended. | |||||
| CVE-2026-116284 | 2026-10-26 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-42823 | 1 Microsoft | 1 Azure Logic Apps | 2026-10-26 | N/A | 9.9 CRITICAL |
| Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-41102 | 1 Microsoft | 1 Powerpoint | 2026-10-26 | N/A | 7.1 HIGH |
| Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally. | |||||
| CVE-2026-43652 | 1 Apple | 1 Macos | 2026-10-26 | N/A | 7.5 HIGH |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. | |||||
| CVE-2026-28910 | 1 Apple | 1 Macos | 2026-10-26 | N/A | 3.3 LOW |
| This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files. | |||||
| CVE-2026-28993 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-10-26 | N/A | 5.5 MEDIUM |
| This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access user-sensitive data. | |||||
| CVE-2026-44352 | 2026-10-26 | N/A | N/A | ||
| Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3. | |||||
| CVE-2026-44341 | 2026-10-26 | N/A | 5.3 MEDIUM | ||
| GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data. | |||||
| CVE-2026-42177 | 2026-10-26 | N/A | 5.3 MEDIUM | ||
| linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1. | |||||
| CVE-2026-41100 | 1 Microsoft | 1 365 Copilot | 2026-10-26 | N/A | 4.4 MEDIUM |
| Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. | |||||
| CVE-2026-40020 | 2 Dovecot, Open-xchange | 2 Dovecot, Dovecot | 2026-10-26 | N/A | 3.1 LOW |
| Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known. | |||||
| CVE-2026-28974 | 1 Apple | 6 Ipados, Iphone Os, Macos and 3 more | 2026-10-26 | N/A | 7.5 HIGH |
| This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service. | |||||
| CVE-2026-28922 | 1 Apple | 1 Macos | 2026-10-26 | N/A | 6.5 MEDIUM |
| This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information. | |||||
| CVE-2026-41101 | 1 Microsoft | 1 Word | 2026-10-26 | N/A | 7.1 HIGH |
| Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally. | |||||
| CVE-2026-42158 | 2026-10-26 | N/A | N/A | ||
| Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3. | |||||
| CVE-2026-28957 | 1 Apple | 3 Ipados, Iphone Os, Visionos | 2026-10-26 | N/A | 3.3 LOW |
| An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen. | |||||
| CVE-2026-28988 | 1 Apple | 5 Ipados, Iphone Os, Macos and 2 more | 2026-10-26 | N/A | 5.5 MEDIUM |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An app may be able to bypass certain Privacy preferences. | |||||
| CVE-2026-44225 | 2026-10-26 | N/A | 9.3 CRITICAL | ||
| Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1. | |||||