Total
418173 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-97631 | 2026-10-30 | N/A | N/A | ||
| EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability. | |||||
| CVE-2026-96391 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | |||||
| CVE-2026-96389 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1. | |||||
| CVE-2026-96379 | 2026-10-30 | N/A | 3.5 LOW | ||
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3. | |||||
| CVE-2026-96363 | 2026-10-30 | N/A | 3.1 LOW | ||
| Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | |||||
| CVE-2026-95673 | 2026-10-30 | N/A | N/A | ||
| Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-92243. Reason: This candidate is a reservation duplicate of CVE-2026-92243. Notes: All CVE users should reference CVE-2026-92243 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | |||||
| CVE-2026-95117 | 2026-10-30 | N/A | 3.7 LOW | ||
| Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components | |||||
| CVE-2026-88086 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network. | |||||
| CVE-2026-88084 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. | |||||
| CVE-2026-88081 | 2026-10-30 | N/A | 7.7 HIGH | ||
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-87938 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2. | |||||
| CVE-2026-87346 | 2026-10-30 | N/A | 8.7 HIGH | ||
| Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). | |||||
| CVE-2026-86959 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination. | |||||
| CVE-2026-86948 | 1 Apple | 1 Xcode | 2026-10-30 | N/A | 8.8 HIGH |
| This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox. | |||||
| CVE-2026-86944 | 2026-10-30 | N/A | 5.5 MEDIUM | ||
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. | |||||
| CVE-2026-86935 | 1 Apple | 1 Macos | 2026-10-30 | N/A | 5.5 MEDIUM |
| This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user-sensitive data. | |||||
| CVE-2026-84582 | 2026-10-30 | N/A | 5.5 MEDIUM | ||
| A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data. | |||||
| CVE-2026-81627 | 2026-10-30 | N/A | 8.2 HIGH | ||
| A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. | |||||
| CVE-2026-7005 | 2026-10-30 | N/A | 6.1 MEDIUM | ||
| WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path. | |||||
| CVE-2026-79884 | 2026-10-30 | N/A | 8.2 HIGH | ||
| A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise. | |||||