Total
30000 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-41100 | 1 Microsoft | 1 365 Copilot | 2026-10-26 | N/A | 4.4 MEDIUM |
| Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. | |||||
| CVE-2026-34654 | 1 Adobe | 3 Commerce, Commerce B2b, Magento | 2026-10-26 | N/A | 5.3 MEDIUM |
| Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-21016 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 5.5 MEDIUM |
| Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. | |||||
| CVE-2026-21020 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 7.8 HIGH |
| Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions. | |||||
| CVE-2026-21022 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 5.5 MEDIUM |
| Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. | |||||
| CVE-2026-21027 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 3.3 LOW |
| Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function. | |||||
| CVE-2026-21029 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 7.8 HIGH |
| Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations. | |||||
| CVE-2026-21017 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 5.5 MEDIUM |
| Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files. | |||||
| CVE-2026-46461 | 1 Dell | 1 Server Hardware Manager | 2026-10-26 | N/A | 7.8 HIGH |
| Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | |||||
| CVE-2026-21026 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 5.5 MEDIUM |
| Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information. | |||||
| CVE-2026-50090 | 1 Aqara | 1 Cloud Oauth Authorization Endpoint | 2026-10-26 | N/A | 9.3 CRITICAL |
| The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe Equivalence in Input" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3 Critical). | |||||
| CVE-2026-21025 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 5.5 MEDIUM |
| Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. | |||||
| CVE-2026-45176 | 4 Apple, Linux, Microsoft and 1 more | 4 Macos, Linux Kernel, Windows and 1 more | 2026-10-26 | N/A | 7.8 HIGH |
| Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actions with elevated privileges. CyberArk Security Bulletin: CA26-19 | |||||
| CVE-2026-59841 | 2 Fortinet, Microsoft | 2 Fortisiem, Windows | 2026-10-24 | N/A | 7.5 HIGH |
| A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here> | |||||
| CVE-2026-58617 | 1 Microsoft | 1 365 Copilot | 2026-10-24 | N/A | 8.1 HIGH |
| Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2006-2073 | 1 Isc | 1 Bind | 2026-10-24 | 5.0 MEDIUM | N/A |
| Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a "broken" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite. | |||||
| CVE-2026-35425 | 1 Microsoft | 1 Azure Api Management | 2026-10-24 | N/A | 8.0 HIGH |
| Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. | |||||
| CVE-2023-23919 | 1 Nodejs | 1 Node.js | 2026-10-24 | N/A | 7.5 HIGH |
| A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service. | |||||
| CVE-2022-44566 | 1 Activerecord Project | 1 Activerecord | 2026-10-24 | N/A | 7.5 HIGH |
| A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service. | |||||
| CVE-2023-22648 | 1 Suse | 1 Rancher | 2026-10-24 | N/A | 8.0 HIGH |
| A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4. | |||||