Export limit exceeded: 419171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419171 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112343 | 1 Syncplify | 1 Syncplify Server! | 2026-11-03 | 8.1 High |
| Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access. | ||||
| CVE-2026-112344 | 1 Syncplify | 1 Syncplify Server! | 2026-11-03 | 6.8 Medium |
| Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary. | ||||
| CVE-2026-116740 | 1 Netsurf-browser | 1 Libcss | 2026-11-03 | 6.5 Medium |
| libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash. | ||||
| CVE-2026-107017 | 1 Vokimon | 1 Vokibot | 2026-11-03 | 9.1 Critical |
| Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions. | ||||
| CVE-2026-107018 | 1 Ghostsq-commander | 1 File Manager | 2026-11-03 | 8.1 High |
| Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage. | ||||
| CVE-2026-107020 | 1 Yanus171 | 1 Handy-news-reader | 2026-11-03 | 7.5 High |
| An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL. | ||||
| CVE-2026-107023 | 1 Mhss1 | 1 Mybrain | 2026-11-03 | 6.5 Medium |
| Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content. | ||||
| CVE-2026-107025 | 1 Wikiandpad | 1 Wikiandpad | 2026-11-03 | 7.5 High |
| Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data. | ||||
| CVE-2026-107029 | 1 Rubenalfon | 1 Pile | 2026-11-03 | 9.1 Critical |
| Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | ||||
| CVE-2026-107032 | 1 Alexghr | 1 Bulkshare | 2026-11-03 | 9.1 Critical |
| Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | ||||
| CVE-2026-107042 | 1 Usp | 1 Ultimate Screenshot Painter | 2026-11-03 | 7.5 High |
| Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI. | ||||
| CVE-2026-107044 | 1 Projectmaxs | 1 Maxs | 2026-11-03 | 7.5 High |
| Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism. | ||||
| CVE-2026-107046 | 1 Antennapod | 1 Antennapod | 2026-11-03 | 5.3 Medium |
| A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL. | ||||
| CVE-2026-107051 | 1 Klassm | 1 Andfhem | 2026-11-03 | 7.5 High |
| Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations. | ||||
| CVE-2026-51832 | 1 Idrive | 1 Idrive Backup | 2026-11-03 | 7.8 High |
| An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component | ||||
| CVE-2026-113387 | 2 Canva, Wordpress-extensions | 2 Ortto, Ortto | 2026-11-03 | 8.6 High |
| The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts. | ||||
| CVE-2026-121506 | 1 Ntpsec | 1 Ntpsec | 2026-11-03 | 7.4 High |
| An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field. | ||||
| CVE-2026-121507 | 1 D3tn | 1 Ud3tn | 2026-11-03 | 5.9 Medium |
| Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure | ||||
| CVE-2026-121508 | 1 D3tn | 1 Ud3tn | 2026-11-03 | 5.9 Medium |
| Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure | ||||
| CVE-2026-121510 | 1 D3tn | 1 Ud3tn | 2026-11-03 | 7.5 High |
| Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS | ||||