Export limit exceeded: 399588 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 399588 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 399588 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 399588 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (399588 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86132 | 1 Watchguard | 1 Fireware Os | 2026-09-29 | N/A |
| An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite. | ||||
| CVE-2026-86128 | 1 Watchguard | 1 Fireware Os | 2026-09-29 | N/A |
| A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet. | ||||
| CVE-2026-81433 | 1 Watchguard | 1 Fireware Os | 2026-09-29 | N/A |
| A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet. | ||||
| CVE-2026-103048 | 2026-09-29 | N/A | ||
| URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10. | ||||
| CVE-2026-95353 | 1 Google | 1 Chrome | 2026-09-29 | 8.8 High |
| Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95363 | 1 Google | 1 Chrome | 2026-09-29 | 5.4 Medium |
| UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95354 | 1 Google | 1 Chrome | 2026-09-29 | 8.3 High |
| Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-95323 | 1 Google | 1 Chrome | 2026-09-29 | 5.4 Medium |
| UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95312 | 1 Google | 1 Chrome | 2026-09-29 | 3.1 Low |
| Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95334 | 1 Google | 1 Chrome | 2026-09-29 | 8.3 High |
| Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-95319 | 1 Google | 1 Chrome | 2026-09-29 | 8.3 High |
| Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-95326 | 1 Google | 1 Chrome | 2026-09-29 | N/A |
| Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-95309 | 1 Google | 1 Chrome | 2026-09-29 | 5.4 Medium |
| UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-95380 | 1 Google | 1 Chrome | 2026-09-29 | 8.8 High |
| Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-102823 | 1 Eugeny | 1 Russh | 2026-09-29 | 7.5 High |
| Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1. | ||||
| CVE-2026-95299 | 1 Google | 1 Chrome | 2026-09-29 | 9.6 Critical |
| Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102677 | 1 Electron | 1 Electron | 2026-09-29 | 7.8 High |
| Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6. | ||||
| CVE-2026-102716 | 1 Eclipse | 1 Threadx Netx Duo | 2026-09-29 | N/A |
| An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: ```c /* addons/rtsp/nx_rtsp_server.c:2754 */ status = _nx_utility_string_to_uint(field_value_ptr, field_value_length, &session_id); if (status) { return(status); /* NX_INVALID_PARAMETERS / NX_SIZE_ERROR / NX_OVERFLOW */ } ``` Every other branch of the same function maps its failure to an RTSP status first. The CSeq branch eighteen lines earlier does exactly that (line 2736 returns NX_RTSP_STATUS_CODE_BAD_REQUEST). The raw code then reaches `_nx_rtsp_server_error_response_send` (nx_rtsp_server.c:1234), which does not recognise it, takes a path that returns without releasing the response packet it already allocated, and the block never goes back to the pool. Six requests with an empty Session header against a 22 packet pool: ``` valid requests: after request 6: pool available = 21, AFTER = 22 / 22 malformed requests: after request 6: pool available = 16, AFTER = 17 / 22 ``` One block per request, not returned when the client disconnects. Twenty six requests take the pool to zero and the server starts failing allocations, after which it serves nobody. If the pool is shared with the rest of the application, as it is in the shipped sample, the rest of the stack stops with it. Convert the `_nx_utility_string_to_uint` failure in the Session branch into NX_RTSP_STATUS_CODE_BAD_REQUEST the way the CSeq branch does, and release the response packet on every exit path of `_nx_rtsp_server_error_response_send`. | ||||
| CVE-2026-103047 | 2026-09-29 | N/A | ||
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10. | ||||
| CVE-2026-103044 | 2026-09-29 | N/A | ||
| XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10. | ||||