Export limit exceeded: 371219 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 371219 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 371219 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371219 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-43803 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-07-28 | 9.8 Critical |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote attacker may be able to cause unexpected system termination. | ||||
| CVE-2026-64766 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-07-28 | 7.8 High |
| An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. | ||||
| CVE-2026-64731 | 1 Apple | 1 Macos | 2026-07-28 | 9.8 Critical |
| A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox. | ||||
| CVE-2026-43710 | 1 Apple | 1 Macos | 2026-07-28 | 9.8 Critical |
| The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-51296 | 1 Sqlite | 1 Sqlite | 2026-07-28 | 7.5 High |
| SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information. | ||||
| CVE-2026-43757 | 1 Apple | 1 Macos | 2026-07-28 | 9.8 Critical |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-64726 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-07-28 | 9.8 Critical |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker in physical proximity may be able to corrupt process memory. | ||||
| CVE-2026-53667 | 1 Remix-run | 1 React-router | 2026-07-28 | 6.9 Medium |
| React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0. | ||||
| CVE-2026-43747 | 1 Apple | 1 Macos | 2026-07-28 | 7.1 High |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Parsing a maliciously crafted file may lead to an unexpected app termination. | ||||
| CVE-2026-43730 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-07-28 | 9.8 Critical |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user. | ||||
| CVE-2026-64697 | 1 Apple | 1 Macos | 2026-07-28 | N/A |
| The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-53668 | 1 Remix-run | 1 React-router | 2026-07-28 | 6.9 Medium |
| React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0. | ||||
| CVE-2026-12741 | 2026-07-28 | 7.5 High | ||
| The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-63922 | 1 Linux | 1 Linux Kernel | 2026-07-28 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage. | ||||
| CVE-2026-51302 | 1 Sqlite | 1 Sqlite | 2026-07-28 | 9.8 Critical |
| SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, or potentially execute arbitrary code on the affected system. | ||||
| CVE-2026-55685 | 1 Remix-run | 1 React-router | 2026-07-28 | 6.5 Medium |
| React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0. | ||||
| CVE-2026-51300 | 1 Sqlite | 1 Sqlite | 2026-07-28 | 9.1 Critical |
| A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By constructing malicious SQL queries, a remote attacker can trigger invalid memory access, leading to application crash and sensitive memory information leakage. | ||||
| CVE-2026-65438 | 2 Kofimokome, Wordpress | 2 Message Filter For Contact Form 7, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. | ||||
| CVE-2026-65440 | 2 Roxnor, Wordpress | 2 Getgenie, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. | ||||
| CVE-2026-65447 | 2 Wasiliy Strecker / Contestgallery Developer, Wordpress | 2 Contest Gallery, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. | ||||