Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
83,150 matching · page 87/1663Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-117873(opens NVD record) | High | 8.1 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117872(opens NVD record) | High | 8.8 | Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117871(opens NVD record) | High | 7.3 | Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117870(opens NVD record) | High | 7.3 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117869(opens NVD record) | High | 8.8 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117868(opens NVD record) | Critical | 9.6 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117867(opens NVD record) | High | 7.3 | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117866(opens NVD record) | High | 7.3 | Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117865(opens NVD record) | Medium | 6.3 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117864(opens NVD record) | High | 8.8 | Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117863(opens NVD record) | Medium | 6.5 | Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117862(opens NVD record) | Critical | 9.8 | Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117861(opens NVD record) | Critical | 9.6 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117860(opens NVD record) | High | 8.1 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Oct 27, 2026 |
| CVE-2026-117603(opens NVD record) | Medium | 4.3 | Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit. | Oct 27, 2026 |
| CVE-2026-117602(opens NVD record) | High | 8.4 | Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process. | Oct 27, 2026 |
| CVE-2026-117601(opens NVD record) | High | 7.5 | Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it. | Oct 27, 2026 |
| CVE-2026-117573(opens NVD record) | High | 7.8 | hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user. | Oct 27, 2026 |
| CVE-2026-117570(opens NVD record) | Medium | 5.2 | Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets. | Oct 27, 2026 |
| CVE-2026-117569(opens NVD record) | High | 7.8 | Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user. | Oct 27, 2026 |
| CVE-2026-117568(opens NVD record) | High | 7.0 | mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user. | Oct 27, 2026 |
| CVE-2026-117567(opens NVD record) | High | 7.8 | esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user. | Oct 27, 2026 |
| CVE-2026-117566(opens NVD record) | Medium | 5.3 | EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server. | Oct 27, 2026 |
| CVE-2026-117565(opens NVD record) | Medium | 5.3 | Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list. | Oct 27, 2026 |
| CVE-2026-117564(opens NVD record) | Critical | 9.8 | nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access. | Oct 27, 2026 |
| CVE-2026-117563(opens NVD record) | Medium | 5.4 | MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents. | Oct 27, 2026 |
| CVE-2026-117562(opens NVD record) | Medium | 5.3 | rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories. | Oct 27, 2026 |
| CVE-2026-117561(opens NVD record) | High | 7.8 | Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user. | Oct 27, 2026 |
| CVE-2026-117560(opens NVD record) | High | 7.8 | ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user. | Oct 27, 2026 |
| CVE-2026-117559(opens NVD record) | High | 7.8 | DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices. | Oct 27, 2026 |
| CVE-2026-117558(opens NVD record) | High | 7.8 | The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user. | Oct 27, 2026 |
| CVE-2026-117557(opens NVD record) | Medium | 6.1 | SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory. | Oct 27, 2026 |
| CVE-2026-117556(opens NVD record) | Medium | 4.3 | zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application. | Oct 27, 2026 |
| CVE-2026-117555(opens NVD record) | Medium | 6.1 | CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image. | Oct 27, 2026 |
| CVE-2026-117554(opens NVD record) | Medium | 4.3 | Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering. | Oct 27, 2026 |
| CVE-2026-117553(opens NVD record) | High | 7.5 | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates. | Oct 27, 2026 |
| CVE-2026-117504(opens NVD record) | Medium | 5.3 | A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised. | Oct 27, 2026 |
| CVE-2026-117503(opens NVD record) | Medium | 5.3 | A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component. | Oct 27, 2026 |
| CVE-2026-10537(opens NVD record) | Medium | 5.3 | A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions | Oct 27, 2026 |
| CVE-2026-107067(opens NVD record) | Medium | 6.2 | An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information | Oct 27, 2026 |
| CVE-2026-92546(opens NVD record) | High | 7.5 | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e. | Oct 27, 2026 |
| CVE-2026-65151(opens NVD record) | High | 8.4 | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure. | Oct 27, 2026 |
| CVE-2026-65145(opens NVD record) | Critical | 10.0 | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | Oct 27, 2026 |
| CVE-2026-65120(opens NVD record) | High | 7.1 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure. | Oct 27, 2026 |
| CVE-2026-65119(opens NVD record) | High | 8.4 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service. | Oct 27, 2026 |
| CVE-2026-47486(opens NVD record) | High | 7.8 | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure. | Oct 27, 2026 |
| CVE-2026-24269(opens NVD record) | High | 7.1 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering. | Oct 27, 2026 |
| CVE-2026-15586(opens NVD record) | Medium | 5.3 | Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force. This issue affects Ontime: through 2026-10-27. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | Oct 27, 2026 |
| CVE-2026-116627(opens NVD record) | High | 8.7 | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL. | Oct 27, 2026 |
| CVE-2026-114409(opens NVD record) | Unscored | — | Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps. | Oct 27, 2026 |