Export limit exceeded: 392014 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 392014 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 392014 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (392014 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16140 | 2026-09-15 | 8.8 High | ||
| OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C. This issue effectively allows for privilege escalation without re-authentication. | ||||
| CVE-2026-14986 | 1 Zephyrproject | 1 Zephyr | 2026-09-15 | 6.8 Medium |
| The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store. | ||||
| CVE-2026-14277 | 1 Ibm | 1 I Access Family | 2026-09-15 | 6.3 Medium |
| IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file. | ||||
| CVE-2026-13285 | 1 Ibm | 1 Mq | 2026-09-15 | 7.1 High |
| IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | ||||
| CVE-2025-9606 | 1 Portabilis | 1 I-educar | 2026-09-15 | 6.3 Medium |
| A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.12 addresses this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced." | ||||
| CVE-2025-9531 | 1 Portabilis | 1 I-educar | 2026-09-15 | 6.3 Medium |
| A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing a manipulation of the argument cod_agenda results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. It is suggested to upgrade the affected component. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced." | ||||
| CVE-2026-28662 | 1 Google | 1 Android | 2026-09-15 | 8 High |
| In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28658 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28657 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-78299 | 2026-09-15 | 9.1 Critical | ||
| In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk. | ||||
| CVE-2026-92050 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92051 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92053 | 1 Mozilla | 1 Firefox | 2026-09-15 | 8.8 High |
| Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92055 | 1 Mozilla | 1 Firefox | 2026-09-15 | 8.8 High |
| Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92057 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92058 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92059 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92061 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92062 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92063 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156. | ||||