Total
419339 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-107059 | 2026-11-03 | N/A | 7.5 HIGH | ||
| An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication. | |||||
| CVE-2026-107053 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox. | |||||
| CVE-2026-107048 | 2026-11-03 | N/A | 9.8 CRITICAL | ||
| An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request. | |||||
| CVE-2026-107043 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism. | |||||
| CVE-2026-107038 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data. | |||||
| CVE-2026-107033 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database. | |||||
| CVE-2026-107027 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | |||||
| CVE-2026-107021 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database. | |||||
| CVE-2026-107016 | 2026-11-03 | N/A | 7.5 HIGH | ||
| Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | |||||
| CVE-2026-112492 | 1 Apple | 1 Macos | 2026-11-03 | N/A | 7.0 HIGH |
| A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | |||||
| CVE-2026-4405 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | N/A | 4.0 MEDIUM |
| IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system. | |||||
| CVE-2026-112487 | 1 Apple | 1 Macos | 2026-11-03 | N/A | 7.8 HIGH |
| A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | |||||
| CVE-2026-4413 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | N/A | 6.1 MEDIUM |
| IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2026-6719 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-11-03 | N/A | 7.5 HIGH |
| IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | |||||
| CVE-2026-107366 | 1 Langflow | 1 Langflow | 2026-11-03 | N/A | 8.3 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID. | |||||
| CVE-2026-112414 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-11-03 | N/A | 6.5 MEDIUM |
| A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted message may lead to a denial-of-service. | |||||
| CVE-2026-112479 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2026-11-03 | N/A | 5.2 MEDIUM |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious USB device may be able to cause unexpected system termination or read kernel memory. | |||||
| CVE-2026-86988 | 1 Apple | 6 Ipados, Iphone Os, Macos and 3 more | 2026-11-03 | N/A | 4.3 MEDIUM |
| The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory. | |||||
| CVE-2026-101409 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-11-03 | N/A | 7.5 HIGH |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | |||||
| CVE-2026-101413 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-11-03 | N/A | 5.3 MEDIUM |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). | |||||