Total
926 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-16370 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16356 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16383 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16407 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16406 | 1 Mozilla | 1 Firefox | 2026-10-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16377 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. | |||||
| CVE-2026-16388 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16394 | 1 Mozilla | 1 Firefox | 2026-10-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-44982 | 2026-10-24 | N/A | 7.2 HIGH | ||
| CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8. | |||||
| CVE-2026-16382 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-16380 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | |||||
| CVE-2026-60164 | 1 Oracle | 2 Jdk, Jre | 2026-10-24 | N/A | 3.1 LOW |
| Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). | |||||
| CVE-2026-60166 | 1 Oracle | 2 Jdk, Jre | 2026-10-24 | N/A | 3.1 LOW |
| Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). | |||||
| CVE-2026-46403 | 2026-10-24 | N/A | 6.3 MEDIUM | ||
| Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution mechanism. The hook saves the previous read-only state, sets `runtime.SetReadOnly(true)`, executes the destination context, and then restores the previous read-only state. However, the indirect contract delete and upgrade paths do not reject execution when `runtime.ReadOnly()` is true. As a result, a contract reached through read-only execution can call the production delete hook for a target contract it owns. The delete path appends the target address to `vmOutput.DeletedAccounts`, the output context merges `DeletedAccounts` into the caller output, and the smart contract processor later processes the VM output by deleting accounts listed in that field. The root cause is that read-only mode is applied as runtime state, but not enforced by the state-changing delete and upgrade host-core paths. This breaks the expected isolation boundary for workflows that rely on read-only calls to inspect another contract without allowing that callee to produce state-changing VM output. The issue is fixed in v1.7.17. Contract delete and upgrade host-core paths now reject execution when `runtime.ReadOnly()` is true. The invariant is regression-tested for delete, upgrade, storage writes, value transfers, and any VM output field that can later mutate chain state. | |||||
| CVE-2026-56585 | 1 Hcltech | 1 Intelliops Event Management | 2026-10-24 | N/A | 3.1 LOW |
| HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions. | |||||
| CVE-2026-70444 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-69278 | 1 Microsoft | 1 Visual Studio Code | 2026-10-24 | N/A | 7.8 HIGH |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-54981 | 1 Microsoft | 2 Python, Visual Studio Code | 2026-10-24 | N/A | 7.8 HIGH |
| Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-72781 | 2026-10-24 | N/A | 8.8 HIGH | ||
| Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox(). | |||||
| CVE-2026-66391 | 1 Apache | 1 Wicket | 2026-10-24 | N/A | 6.5 MEDIUM |
| Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue. | |||||