Export limit exceeded: 11784 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11784 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113276 | 1 Google | 2 Android, Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113245 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-113227 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113286 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113062 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113244 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113265 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113144 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Missing authorization in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113235 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113186 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low) | ||||
| CVE-2026-113187 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113184 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113047 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113048 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-113116 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-113083 | 1 Google | 2 Android, Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-installed app. (Chromium security severity: Low) | ||||
| CVE-2026-113107 | 1 Google | 2 Android, Chrome | 2026-11-04 | 8.8 High |
| Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-9771 | 1 Zephyrproject | 1 Zephyr | 2026-11-04 | 8.8 High |
| The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * arguments, src_dev and dst_dev, directly into the implementation without any object validation — unlike every sibling flash syscall, which guards its device pointer with K_SYSCALL_DRIVER_FLASH. A user-mode thread fully controls the values of src_dev/dst_dev and the contents of its own address space. The implementation z_impl_flash_copy() dereferences these pointers and calls through their driver-API function tables (e.g. api->get_parameters(dst_dev), flash_read(src_dev, ...), flash_write(dst_dev, ...)). By supplying a pointer to a forged struct device whose api table contains attacker-chosen function pointers, an unprivileged thread can cause the kernel to call arbitrary code in supervisor mode; passing any arbitrary or invalid address otherwise yields a kernel crash or out-of-bounds read. The result is a local privilege escalation out of the userspace sandbox (with kernel denial-of-service and information disclosure as lesser outcomes). The fix adds K_SYSCALL_DRIVER_FLASH(src_dev, read) and K_SYSCALL_DRIVER_FLASH(dst_dev, write) to z_vrfy_flash_copy(), which verify each device is a registered flash-driver kernel object the calling thread is permitted to use before any dereference, closing the path completely. | ||||
| CVE-2026-12631 | 1 Zephyrproject | 1 Zephyr | 2026-11-04 | 6.5 Medium |
| The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c. Its default switch branch is the access-denied path, taken when k_object_validate() returns -EPERM (the calling user thread was never granted access to the target thread object) or -EBADF (the supplied pointer is not a registered kernel object of the right type). That branch invoked K_OOPS(K_SYSCALL_VERIFY_MSG(ret, "access denied")), but K_SYSCALL_VERIFY_MSG treats a true expression as success; the non-zero error code ret therefore read as "verified OK", the kernel oops was never raised, and control fell through to CODE_UNREACHABLE. Because k_thread_join() and k_thread_abort() are system calls, an unprivileged user-mode thread (under CONFIG_USERSPACE) can reach this denial path directly by calling either syscall on a thread object it does not own. Instead of the offending thread being cleanly terminated, execution reaches __builtin_unreachable() while running in supervisor mode inside the syscall handler. On Clang builds CODE_UNREACHABLE emits an illegal-instruction trap, so a user thread can deterministically crash the kernel — a locally triggerable denial of service that escapes the userspace sandbox. On GCC builds the path is undefined behavior: the compiler may drop the return-value handling for thread_obj_validate(), so it can return an undefined bool; if that is false, the caller proceeds into the real k_thread_join()/k_thread_abort() implementation for a thread the user was never authorized to access, an access-control bypass. The fix changes the verification expression to ret == 0, so a denied (non-zero) result now correctly raises K_OOPS and terminates the offending caller. | ||||
| CVE-2026-112428 | 1 Apple | 1 Macos | 2026-11-04 | 5.5 Medium |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may bypass Gatekeeper checks. | ||||