Export limit exceeded: 26138 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419220 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419220 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120422 | 2026-11-04 | N/A | ||
| Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application. | ||||
| CVE-2026-121233 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121140 | 1 Google | 1 Chrome | 2026-11-04 | 8.3 High |
| Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121188 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121044 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121100 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121249 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121241 | 1 Google | 1 Chrome | 2026-11-04 | 9.6 Critical |
| Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121182 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121137 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121208 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-121238 | 1 Google | 1 Chrome | 2026-11-04 | 8.8 High |
| Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-82158 | 1 Dell | 1 Wyse Management Suite | 2026-11-04 | 9 Critical |
| Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2026-82161 | 1 Dell | 1 Wyse Management Suite | 2026-11-04 | 6.8 Medium |
| Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2026-22060 | 1 Netapp | 1 Storagegrid | 2026-11-04 | N/A |
| All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid. | ||||
| CVE-2026-11753 | 1 Ly Corporation | 1 Armeria | 2026-11-04 | N/A |
| A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL. | ||||
| CVE-2026-111962 | 2026-11-04 | N/A | ||
| The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data. | ||||
| CVE-2026-112243 | 2026-11-04 | N/A | ||
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link. | ||||
| CVE-2026-114431 | 1 Wordpress-extensions | 1 Enable Media Replace | 2026-11-04 | N/A |
| The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads. | ||||
| CVE-2026-115242 | 2026-11-04 | N/A | ||
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory. | ||||