Export limit exceeded: 392226 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (392226 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92055 | 1 Mozilla | 1 Firefox | 2026-09-15 | 8.8 High |
| Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92057 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92058 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92059 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92061 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92062 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92063 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92064 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92065 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92066 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92067 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92068 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92070 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92071 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-28656 | 1 Google | 1 Android | 2026-09-15 | 7.3 High |
| In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-28655 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28650 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28644 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-85014 | 2 Nodejs, Undici | 2 Undici, Undici | 2026-09-15 | 5.9 Medium |
| undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2. | ||||
| CVE-2026-28642 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||