Export limit exceeded: 424331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424336 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112257 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file. | ||||
| CVE-2026-106062 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process. | ||||
| CVE-2026-95619 | 1 Redhat | 7 Enterprise Linux, Hardened Images, Hummingbird and 4 more | 2026-11-11 | 7.7 High |
| A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability. | ||||
| CVE-2026-124255 | 2026-11-11 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allows Code Injection.This issue affects Events Made Easy: from n/a through 3.3.5. | ||||
| CVE-2026-124421 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through 2.8.2. | ||||
| CVE-2025-66364 | 1 Samsung Semiconductor | 20 Exynos 1080, Exynos 1280, Exynos 1330 and 17 more | 2026-11-11 | 7.5 High |
| Continuously sending control‑plane messages causes the baseband to crashes. | ||||
| CVE-2025-66368 | 1 Samsung Semiconductor | 3 Exynos 1080, Exynos 9110, Exynos Modem 5123 | 2026-11-11 | 7.5 High |
| Incorrect handling of SDP payload leads to a Denial of Service | ||||
| CVE-2026-125680 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11. | ||||
| CVE-2026-124753 | 2026-11-11 | 4.3 Medium | ||
| Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. | ||||
| CVE-2026-125437 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0. | ||||
| CVE-2026-121028 | 2026-11-11 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials strong-testimonials allows Code Injection.This issue affects Strong Testimonials: from n/a through 3.3.17. | ||||
| CVE-2026-121574 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20. | ||||
| CVE-2026-125761 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0. | ||||
| CVE-2026-119883 | 1 Microsoft | 4 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 1 more | 2026-11-11 | 3.3 Low |
| Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-92747 | 1 Redhat | 1 Enterprise Linux | 2026-11-11 | 5 Medium |
| A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies. | ||||
| CVE-2026-92745 | 1 Redhat | 1 Enterprise Linux | 2026-11-11 | 5 Medium |
| A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens. | ||||
| CVE-2026-92768 | 1 Redhat | 1 Enterprise Linux | 2026-11-11 | 5.5 Medium |
| A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access. | ||||
| CVE-2026-121770 | 2026-11-11 | 5.4 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5. | ||||
| CVE-2026-119832 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-11-11 | 5.9 Medium |
| Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack. | ||||
| CVE-2026-121014 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. | ||||