Export limit exceeded: 18036 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18036 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108304 | 2026-10-27 | 7.8 High | ||
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-117868 | 2026-10-27 | N/A | ||
| Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. | ||||
| CVE-2026-117928 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-107671 | 1 Veeam | 1 One | 2026-10-27 | N/A |
| A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. | ||||
| CVE-2026-117998 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-117512 | 1 Oretnom23 | 1 Php-travel-agency-system | 2026-10-27 | 7.3 High |
| A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-117995 | 2026-10-27 | N/A | ||
| Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6. | ||||
| CVE-2026-82984 | 2026-10-27 | N/A | ||
| When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers. | ||||
| CVE-2026-77173 | 2026-10-27 | N/A | ||
| A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. | ||||
| CVE-2026-67400 | 2026-10-27 | N/A | ||
| A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. | ||||
| CVE-2026-77171 | 2026-10-27 | N/A | ||
| A public shared collective always allowed recipients of the link to create pages. | ||||
| CVE-2026-82986 | 2026-10-27 | N/A | ||
| The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. | ||||
| CVE-2026-82332 | 1 Watchguard | 1 Fireware Os | 2026-10-27 | N/A |
| An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification. | ||||
| CVE-2026-93866 | 1 Watchguard | 1 Fireware Os | 2026-10-27 | N/A |
| An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled. | ||||
| CVE-2026-83398 | 1 Oracle | 1 Data Integrator | 2026-10-27 | 8.2 High |
| Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data as well as unauthorized update, insert or delete access to some of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). | ||||
| CVE-2026-116809 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 5.3 Medium |
| OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes. | ||||
| CVE-2026-116604 | 1 Sourcecodester | 1 Online Food Ordering System | 2026-10-27 | 6.5 Medium |
| A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-116507 | 1 Totolink | 2 A950rg, A950rg Firmware | 2026-10-27 | 5.3 Medium |
| A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-83358 | 1 Oracle | 1 Hrms | 2026-10-27 | 6.5 Medium |
| Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-92376 | 2026-10-27 | 7.8 High | ||
| Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation. | ||||