Export limit exceeded: 415437 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415437 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415437 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77171 | 2026-10-27 | N/A | ||
| A public shared collective always allowed recipients of the link to create pages. | ||||
| CVE-2026-77172 | 2026-10-27 | N/A | ||
| App passwords were allowed to bypass password confirmation on sensitive endpoints. | ||||
| CVE-2026-87897 | 2026-10-27 | N/A | ||
| A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard. | ||||
| CVE-2026-82983 | 2026-10-27 | N/A | ||
| The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels. | ||||
| CVE-2026-82986 | 2026-10-27 | N/A | ||
| The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. | ||||
| CVE-2026-117923 | 2026-10-27 | N/A | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117927 | 2026-10-27 | N/A | ||
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117929 | 2026-10-27 | N/A | ||
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117938 | 2026-10-27 | N/A | ||
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117942 | 2026-10-27 | N/A | ||
| Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117947 | 2026-10-27 | N/A | ||
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-117555 | 2 Cimg, Greyclab | 2 Cimg, Cimg | 2026-10-27 | 6.1 Medium |
| CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image. | ||||
| CVE-2026-117963 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-54462 | 2026-10-27 | 6.5 Medium | ||
| Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f. | ||||
| CVE-2026-112353 | 2026-10-27 | 8.2 High | ||
| GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer. | ||||
| CVE-2026-14255 | 1 Autodesk | 2 Revit, Shared Components | 2026-10-27 | 5.5 Medium |
| A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file. | ||||
| CVE-2026-113775 | 1 Autodesk | 1 Fusion | 2026-10-27 | 7.8 High |
| A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process. | ||||
| CVE-2026-109089 | 2026-10-27 | 7.5 High | ||
| A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server. | ||||
| CVE-2026-102638 | 1 Autodesk | 1 Fusion | 2026-10-27 | 7.1 High |
| A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. | ||||
| CVE-2026-63568 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 2 Bc-csharp, Bc-csharp | 2026-10-27 | 7.5 High |
| Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a CMP message or CRMF certificate request whose PBMParameter declares a very large iteration count, because PKMacBuilder enforced its iteration-count ceiling only when the caller had supplied an explicit maximum through the PKMacBuilder(IPKMacPrimitivesProvider, int) constructor. With any other constructor, ProtectedPkiMessage.Verify and CertificateRequestMessage.IsValidSigningKeyPop performed as many hash iterations as the sender requested, up to about 2^31, before the MAC could be checked. | ||||