Export limit exceeded: 17081 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 46812 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46812 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118017 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118016 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118015 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118013 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118012 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118011 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118010 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118009 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118007 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118006 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-118005 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | ||||
| CVE-2026-117987 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117986 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117985 | 1 Mozilla | 1 Firefox | 2026-11-05 | 9.6 Critical |
| Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117974 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-117973 | 1 Mozilla | 1 Firefox | 2026-11-05 | 8.8 High |
| Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | ||||
| CVE-2026-116218 | 1 Dolibarr | 3 Dolibarr, Dolibarr Erp/crm, Dolibarr Erp\/crm | 2026-11-05 | 7.6 High |
| Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries. | ||||
| CVE-2026-116140 | 1 Imagemagick | 1 Imagemagick | 2026-11-05 | 3.3 Low |
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program. | ||||
| CVE-2026-114664 | 1 Frappe | 1 Frappe | 2026-11-05 | 7.1 High |
| Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information. | ||||
| CVE-2026-107912 | 1 Redhat | 10 Apicurio Registry, Build Keycloak, Camel Quarkus and 7 more | 2026-11-05 | 7.7 High |
| A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints. | ||||