Export limit exceeded: 370749 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370749 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72356 | 1 Linux | 1 Linux Kernel | 2026-08-18 | 7.5 High |
| In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value. | ||||
| CVE-2026-72382 | 1 Linux | 1 Linux Kernel | 2026-08-18 | 8.8 High |
| In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression subtracts sizeof(struct smb_acl). Because sizeof() is unsigned, a DACL size smaller than the ACL header underflows to a large size_t. A malicious client can reach this with: SMB2_SET_INFO (InfoType=SMB2_O_INFO_SECURITY) -> smb2_set_info_sec() -> set_info_sec() -> parse_sec_desc() -> parse_dacl() -> init_acl_state(..., 0xffff) -> init_acl_state(..., 0xffff) -> kmalloc_objs(..., 0xffff) Thus a malformed security descriptor can make num_aces pass the guard and drive large temporary ACL state and pointer-array allocations. Reject DACLs smaller than struct smb_acl before doing the subtraction, so the ACE count check cannot be bypassed by the underflow. | ||||
| CVE-2026-72402 | 1 Linux | 1 Linux Kernel | 2026-08-18 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE. BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can also be resolved to kernel pointer values before the verifier log prints the instruction. Include them in the existing pointer classification so the log prints 0x0 instead of the rewritten address. | ||||
| CVE-2026-65346 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 8.8 High |
| An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to arbitrary code execution. | ||||
| CVE-2026-64760 | 1 Apple | 1 Ios And Ipados | 2026-08-18 | 5.5 Medium |
| An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state. | ||||
| CVE-2026-74943 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-13094 | 1 Ibm | 1 I Access Client Solutions | 2026-08-18 | 7.8 High |
| IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file. | ||||
| CVE-2026-59949 | 2026-08-18 | 6.5 Medium | ||
| yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1. | ||||
| CVE-2026-67579 | 2 Ash-hq, Ash-project | 2 Ash Framework, Ash | 2026-08-18 | 7.4 High |
| Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3. | ||||
| CVE-2026-13105 | 1 Ibm | 1 I Access Client Solutions | 2026-08-18 | 8.8 High |
| IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration. | ||||
| CVE-2026-74960 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74977 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-74951 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-74956 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-74959 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74962 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74966 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-74984 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-13367 | 7 Canonical, Hp, Ibm and 4 more | 9 Ubuntu Linux, Hp-ux, Aix and 6 more | 2026-08-18 | 7.8 High |
| IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility. | ||||
| CVE-2026-11788 | 1 Redhat | 12 389 Directory Server, Directory Server, Directory Server E4s and 9 more | 2026-08-18 | 5.9 Medium |
| A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure. | ||||