Export limit exceeded: 389858 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 389858 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389858 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28626 | 1 Google | 1 Android | 2026-09-10 | 7.3 High |
| In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-28631 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28634 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28636 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28639 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28656 | 1 Google | 1 Android | 2026-09-10 | 7.3 High |
| In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-28662 | 1 Google | 1 Android | 2026-09-10 | 8 High |
| In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28663 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28666 | 1 Google | 1 Android | 2026-09-10 | 8.8 High |
| In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28668 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-45520 | 1 Google | 1 Android | 2026-09-10 | 7.8 High |
| In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-21091 | 2026-09-10 | N/A | ||
| Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21092 | 2026-09-10 | N/A | ||
| Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege. | ||||
| CVE-2026-21113 | 2026-09-10 | N/A | ||
| Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission. | ||||
| CVE-2026-69777 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-10 | 8 High |
| Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-69781 | 1 Microsoft | 7 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 4 more | 2026-09-10 | 6.5 Medium |
| Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. | ||||
| CVE-2026-79324 | 1 Mageplaza | 1 Gdpr | 2026-09-10 | 7.5 High |
| Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced. | ||||
| CVE-2026-79323 | 1 Mageplaza | 1 Magefan Blog | 2026-09-10 | 7.5 High |
| Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql. | ||||
| CVE-2026-79322 | 1 Mageplaza | 1 Mageplaza Blog | 2026-09-10 | 8.6 High |
| SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view. | ||||
| CVE-2026-69803 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-10 | 5.9 Medium |
| Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. | ||||