Export limit exceeded: 425051 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 22885 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425051 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425051 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425051 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425051 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90832 | 2026-11-10 | 4.3 Medium | ||
| bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload. The Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends. Exploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync. The consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers. | ||||
| CVE-2026-69555 | 1 Microsoft | 1 Azure Arc | 2026-11-10 | 10 Critical |
| Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66798 | 1 Microsoft | 2 Edge, Edge Chromium | 2026-11-10 | 4.3 Medium |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-68798 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-66805 | 2 Microsoft, Redhat | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-11-10 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-67177 | 2026-11-10 | 5.4 Medium | ||
| Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17. | ||||
| CVE-2026-62757 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 5.3 Medium |
| Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-67176 | 2026-11-10 | 5.4 Medium | ||
| Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17. | ||||
| CVE-2026-68820 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 7 High |
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68807 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68800 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-67175 | 2026-11-10 | 4.6 Medium | ||
| Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17. | ||||
| CVE-2026-62878 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-11-10 | 9.8 Critical |
| Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62877 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 7.8 High |
| Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62740 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-105613 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-10 | 4.7 Medium |
| PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-40375 | 1 Microsoft | 8 Dynamics 365 Business Central 2023 Wave 2, Dynamics 365 Business Central 2024, Dynamics 365 Business Central 2024 Wave 1 and 5 more | 2026-11-10 | 6.5 Medium |
| Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-69836 | 1 Microsoft | 2 Entra Id, Microsoft Entra Id | 2026-11-10 | 10 Critical |
| Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-125298 | 2026-11-10 | 9.8 Critical | ||
| AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41. | ||||
| CVE-2026-125297 | 2026-11-10 | 9.8 Critical | ||
| AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41. | ||||