Export limit exceeded: 22127 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419390 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121818 | 2026-11-04 | 7.8 High | ||
| Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code. | ||||
| CVE-2026-121817 | 2026-11-04 | 7.5 High | ||
| Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions. | ||||
| CVE-2026-121816 | 2026-11-04 | 8.8 High | ||
| Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations. | ||||
| CVE-2026-121621 | 1 Redhat | 1 Openshift Gitops | 2026-11-04 | 8.8 High |
| A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process. | ||||
| CVE-2026-121257 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-121250 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) | ||||
| CVE-2026-121239 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121224 | 1 Google | 1 Chrome | 2026-11-04 | 8.1 High |
| Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) | ||||
| CVE-2026-121211 | 1 Google | 1 Chrome | 2026-11-04 | 8.3 High |
| Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) | ||||
| CVE-2026-121176 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121163 | 1 Google | 1 Chrome | 2026-11-04 | 8.3 High |
| Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-121161 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121133 | 1 Google | 1 Chrome | 2026-11-04 | 8.1 High |
| Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) | ||||
| CVE-2026-121132 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121105 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121073 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low) | ||||
| CVE-2026-121059 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-121049 | 1 Google | 1 Chrome | 2026-11-04 | 3.3 Low |
| Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium) | ||||
| CVE-2026-121038 | 1 Google | 1 Chrome | 2026-11-04 | 6.5 Medium |
| Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-120421 | 1 Eclipse | 1 Eclipse Mojarra | 2026-11-04 | 6.1 Medium |
| In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy. | ||||