Export limit exceeded: 28108 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (28108 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86885 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-09-16 | 6.5 Medium |
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination. | ||||
| CVE-2026-84586 | 1 Apple | 2 Macos, Watchos | 2026-09-16 | 5.5 Medium |
| An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information. | ||||
| CVE-2026-85979 | 1 Perforce Software | 1 Puppet Enterprise | 2026-09-16 | N/A |
| Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system. It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2. This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3. | ||||
| CVE-2026-43664 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-09-16 | 5.5 Medium |
| This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-43687 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-09-16 | 6.5 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may disclose kernel memory. | ||||
| CVE-2026-84538 | 1 Apple | 1 Macos | 2026-09-16 | 6.5 Medium |
| A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service. | ||||
| CVE-2026-86895 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-09-16 | 7.5 High |
| An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier. | ||||
| CVE-2026-39039 | 2026-09-16 | N/A | ||
| In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page. | ||||
| CVE-2026-28960 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-09-16 | 7.5 High |
| A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service. | ||||
| CVE-2026-86883 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-09-16 | 5.5 Medium |
| A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-88261 | 2026-09-16 | N/A | ||
| Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1. | ||||
| CVE-2026-88621 | 2026-09-16 | N/A | ||
| OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service. | ||||
| CVE-2026-25826 | 1 Keyfactor | 1 Signserver | 2026-09-16 | N/A |
| An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss. | ||||
| CVE-2026-92034 | 1 Mozilla | 1 Firefox | 2026-09-16 | N/A |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | ||||
| CVE-2026-58683 | 1 Google | 1 Android | 2026-09-16 | 8.8 High |
| In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58744 | 1 Google | 1 Android | 2026-09-16 | 7.8 High |
| In multiple locations, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56882 | 1 Google | 1 Android | 2026-09-16 | 8.8 High |
| In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56950 | 1 Google | 1 Android | 2026-09-16 | 4.4 Medium |
| In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55332 | 1 Google | 1 Android | 2026-09-16 | 6.7 Medium |
| In multiple locations, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58718 | 1 Google | 1 Android | 2026-09-16 | 6.7 Medium |
| In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||