Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
167,871 matching · page 17/3358Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-120740(opens NVD record) | Low | 2.0 | A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS). | Nov 2, 2026 |
| CVE-2026-120091(opens NVD record) | Unscored | — | Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release. | Nov 2, 2026 |
| CVE-2026-116635(opens NVD record) | Medium | 6.1 | Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1. | Nov 2, 2026 |
| CVE-2026-115403(opens NVD record) | Unscored | — | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread. | Nov 2, 2026 |
| CVE-2026-115215(opens NVD record) | Unscored | — | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions. | Nov 2, 2026 |
| CVE-2026-58977(opens NVD record) | Medium | 6.7 | In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-58930(opens NVD record) | Unscored | — | An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element. | Nov 2, 2026 |
| CVE-2026-58927(opens NVD record) | Unscored | — | The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process. | Nov 2, 2026 |
| CVE-2026-58926(opens NVD record) | Low | 2.5 | A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process. | Nov 2, 2026 |
| CVE-2026-58925(opens NVD record) | Unscored | — | The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process. | Nov 2, 2026 |
| CVE-2026-58924(opens NVD record) | Unscored | — | The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles. | Nov 2, 2026 |
| CVE-2026-58915(opens NVD record) | Medium | 6.1 | A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification. | Nov 2, 2026 |
| CVE-2026-58873(opens NVD record) | High | 8.4 | In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-49906(opens NVD record) | High | 7.8 | An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content. | Nov 2, 2026 |
| CVE-2026-49903(opens NVD record) | Unscored | — | The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI. | Nov 2, 2026 |
| CVE-2026-29508(opens NVD record) | High | 8.8 | ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections. | Nov 2, 2026 |
| CVE-2026-16305(opens NVD record) | Unscored | — | Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates. | Nov 2, 2026 |
| CVE-2026-120503(opens NVD record) | Low | 3.3 | A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended. | Nov 2, 2026 |
| CVE-2026-116958(opens NVD record) | Medium | 6.7 | A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner. | Nov 2, 2026 |
| CVE-2026-116768(opens NVD record) | Unscored | — | CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time. | Nov 2, 2026 |
| CVE-2026-116767(opens NVD record) | Unscored | — | CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service. | Nov 2, 2026 |
| CVE-2026-116766(opens NVD record) | Unscored | — | CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server. | Nov 2, 2026 |
| CVE-2026-105476(opens NVD record) | High | 8.8 | Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges. | Nov 2, 2026 |
| CVE-2026-105475(opens NVD record) | Unscored | — | Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. | Nov 2, 2026 |
| CVE-2026-97718(opens NVD record) | Unscored | — | CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control. | Nov 2, 2026 |
| CVE-2026-91901(opens NVD record) | Low | 3.5 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Client-Side Request Forgery. | Nov 2, 2026 |
| CVE-2026-91900(opens NVD record) | Medium | 5.8 | Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler for Custom URL Scheme vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution, Launch of phishing attacks, and Remote execution. | Nov 2, 2026 |
| CVE-2026-91899(opens NVD record) | Medium | 6.4 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Arbitrary Code Execution. | Nov 2, 2026 |
| CVE-2026-91898(opens NVD record) | High | 8.1 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Elevation of Privilege. | Nov 2, 2026 |
| CVE-2026-91897(opens NVD record) | Medium | 6.4 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service. | Nov 2, 2026 |
| CVE-2026-91896(opens NVD record) | Low | 3.9 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering, Denial of Service and Spoofing of Application Notifications. | Nov 2, 2026 |
| CVE-2026-91895(opens NVD record) | High | 7.1 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering. | Nov 2, 2026 |
| CVE-2026-91894(opens NVD record) | Medium | 6.7 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege, Arbitrary Code Execution and Denial of Service. | Nov 2, 2026 |
| CVE-2026-91893(opens NVD record) | High | 7.8 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege. | Nov 2, 2026 |
| CVE-2026-86365(opens NVD record) | Medium | 4.2 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Input Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service. | Nov 2, 2026 |
| CVE-2026-59048(opens NVD record) | Unscored | — | In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59047(opens NVD record) | Medium | 6.2 | In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59046(opens NVD record) | Medium | 6.2 | In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59045(opens NVD record) | High | 7.4 | In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59044(opens NVD record) | High | 8.4 | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59043(opens NVD record) | High | 7.4 | In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59042(opens NVD record) | High | 7.4 | In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59031(opens NVD record) | Medium | 6.2 | In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59028(opens NVD record) | High | 8.4 | In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59022(opens NVD record) | Unscored | — | In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59021(opens NVD record) | Medium | 6.2 | In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59020(opens NVD record) | Medium | 5.9 | In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59016(opens NVD record) | High | 8.4 | In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59015(opens NVD record) | Medium | 4.0 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |
| CVE-2026-59014(opens NVD record) | High | 8.4 | In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Nov 2, 2026 |