Export limit exceeded: 334991 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (334991 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-20707 | 2 Google, Mediatek | 18 Android, Mt2718, Mt6853 and 15 more | 2026-02-26 | 6.7 Medium |
| In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820. | ||||
| CVE-2025-21456 | 1 Qualcomm | 129 Ar8035, Ar8035 Firmware, C-v2x 9150 and 126 more | 2026-02-26 | 7.8 High |
| Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently. | ||||
| CVE-2025-3586 | 1 Liferay | 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more | 2026-02-26 | 7.2 High |
| In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances. | ||||
| CVE-2025-21458 | 1 Qualcomm | 49 Fastconnect 6900, Fastconnect 6900 Firmware, Qam8255p and 46 more | 2026-02-26 | 7.8 High |
| Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously. | ||||
| CVE-2024-28988 | 1 Solarwinds | 1 Web Help Desk | 2026-02-26 | 9.8 Critical |
| SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. We recommend all Web Help Desk customers apply the patch, which is now available. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities. | ||||
| CVE-2025-46810 | 1 Opensuse | 1 Tumbleweed | 2026-02-26 | 7.8 High |
| A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29. | ||||
| CVE-2025-21461 | 1 Qualcomm | 49 Fastconnect 6900, Fastconnect 6900 Firmware, Fastconnect 7800 and 46 more | 2026-02-26 | 7.8 High |
| Memory corruption when programming registers through virtual CDM. | ||||
| CVE-2025-43726 | 1 Dell | 1 Alienware Command Center | 2026-02-26 | 6.7 Medium |
| Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2025-21473 | 1 Qualcomm | 13 Fastconnect 6900, Fastconnect 6900 Firmware, Fastconnect 7800 and 10 more | 2026-02-26 | 7.8 High |
| Memory corruption when using Virtual cdm (Camera Data Mover) to write registers. | ||||
| CVE-2024-40653 | 1 Google | 1 Android | 2026-02-26 | 7.3 High |
| In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2025-6013 | 1 Hashicorp | 2 Vault, Vault Enterprise | 2026-02-26 | 6.5 Medium |
| Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24. | ||||
| CVE-2024-49720 | 1 Google | 1 Android | 2026-02-26 | 7.8 High |
| In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2025-3354 | 1 Ibm | 1 Tivoli Monitoring | 2026-02-26 | 8.1 High |
| IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. | ||||
| CVE-2024-49730 | 1 Google | 1 Android | 2026-02-26 | 7.8 High |
| In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2025-22416 | 1 Google | 1 Android | 2026-02-26 | 7.8 High |
| In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2025-53786 | 1 Microsoft | 5 Exchange, Exchange Server, Exchange Server 2016 and 2 more | 2026-02-26 | 8 High |
| On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment. | ||||
| CVE-2025-22417 | 1 Google | 1 Android | 2026-02-26 | 7.3 High |
| In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2025-38747 | 1 Dell | 1 Supportassist Os Recovery | 2026-02-26 | 7.8 High |
| Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2025-22418 | 1 Google | 1 Android | 2026-02-26 | 7.8 High |
| In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2025-6633 | 1 Autodesk | 2 3ds Max, 3ds Max | 2026-02-26 | 7.8 High |
| A maliciously crafted RBG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | ||||