Browse All CVEs
40,042 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-55262 |
high | 8.4 | 0.0010 | 2026-11-02 | In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, | |
CVE-2026-49935 |
medium | 4.0 | 0.0011 | 2026-11-02 | In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypa | |
CVE-2026-55257 |
high | 8.4 | 0.0010 | 2026-11-02 | In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to mislea | |
CVE-2026-49931 |
high | 8.4 | 0.0009 | 2026-11-02 | In onActivityResult in multiple locations, there is a possible contact leak from protected | |
CVE-2026-49934 |
high | 7.8 | 0.0008 | 2026-11-02 | In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code executio | |
CVE-2026-49923 |
high | 8.4 | 0.0010 | 2026-11-02 | In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI iss | |
CVE-2026-49924 |
medium | 6.2 | 0.0007 | 2026-11-02 | In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via un | |
CVE-2026-49912 |
medium | 4.0 | 0.0008 | 2026-11-02 | In multiple functions of MediaCarouselController.kt, there is a possible way for media to | |
CVE-2026-49922 |
high | 8.4 | 0.0010 | 2026-11-02 | In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible per | |
CVE-2026-28665 |
high | 8.4 | 0.0009 | 2026-11-02 | In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog | |
CVE-2026-45514 |
high | 8.4 | 0.0011 | 2026-11-02 | In multiple functions of SaveUi.java, there is a possible bypass of package installation r | |
CVE-2026-28643 |
medium | 6.2 | 0.0007 | 2026-11-02 | In multiple locations, there is a possible denial of service due to a missing permission c | |
CVE-2026-28645 |
medium | 6.8 | 0.0014 | 2026-11-02 | In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated ena | |
CVE-2026-28621 |
— | — | 0.0012 | 2026-11-02 | In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due t | |
CVE-2026-28632 |
medium | 4.0 | 0.0008 | 2026-11-02 | In multiple locations, there is a possible way to share files across profiles due to a log | |
CVE-2026-28588 |
high | 8.4 | 0.0010 | 2026-11-02 | In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way t | |
CVE-2026-28597 |
high | 8.4 | 0.0010 | 2026-11-02 | In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permiss | |
CVE-2025-26433 |
high | 8.4 | 0.0008 | 2026-11-02 | In multiple locations, there is a possible way to trick a user into accepting a permission | |
CVE-2026-0053 |
high | 8.4 | 0.0008 | 2026-11-02 | In multiple locations, there is a possible method for a primary user to disable secure nfc | |
CVE-2025-22436 |
high | 8.4 | 0.0008 | 2026-11-02 | In multiple locations, there is a possible way to trick a user into disclosing Autofill co | |
CVE-2026-117082 |
— | — | 0.0020 | 2026-11-02 | An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of | |
CVE-2026-105606 |
critical | 9.5 | 0.0036 | 2026-11-02 | Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables | |
CVE-2026-117127 |
— | — | 0.0042 | 2026-11-02 | Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to ob | |
CVE-2026-119732 |
high | 7.1 | 0.0021 | 2026-11-02 | Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulne | |
CVE-2026-119733 |
high | 7.2 | 0.0033 | 2026-11-02 | Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in | |
CVE-2026-119734 |
high | 7.1 | 0.0024 | 2026-11-02 | Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulne | |
CVE-2026-119735 |
medium | 5.1 | 0.0019 | 2026-11-02 | Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerabili | |
CVE-2026-119736 |
high | 8.8 | 0.0029 | 2026-11-02 | Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier c | |
CVE-2026-120057 |
high | 7.5 | 0.0024 | 2026-11-02 | psqlODBC copies the reply to a large-object read (loread) into the application's buffer us | |
CVE-2026-120058 |
high | 7.5 | 0.0026 | 2026-11-02 | psqlODBC sizes its row cache from the column count of a cursor's first result, but recompu | |
CVE-2026-120059 |
medium | 6.8 | 0.0026 | 2026-11-02 | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, | |
CVE-2026-120060 |
medium | 5.9 | 0.0022 | 2026-11-02 | psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses | |
CVE-2026-120061 |
high | 7.5 | 0.0034 | 2026-11-02 | The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument | |
CVE-2026-120062 |
high | 7.5 | 0.0036 | 2026-11-02 | SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its cata | |
CVE-2026-120063 |
medium | 5.9 | 0.0027 | 2026-11-02 | When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check | |
CVE-2026-120064 |
high | 7.5 | 0.0034 | 2026-11-02 | Several psqlODBC entry points use an application-supplied column number or row index as an | |
CVE-2026-120065 |
high | 7.1 | 0.0029 | 2026-11-02 | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, | |
CVE-2026-120066 |
medium | 5.3 | 0.0011 | 2026-11-02 | On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by d | |
CVE-2026-120067 |
medium | 5.9 | 0.0035 | 2026-11-02 | For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for ta | |
CVE-2026-120497 |
medium | 4.6 | 0.0025 | 2026-11-02 | Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability C | |
CVE-2026-112261 |
high | 7.8 | 0.0017 | 2026-11-02 | A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load | |
CVE-2026-112258 |
high | 7.8 | 0.0017 | 2026-11-02 | A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channe | |
CVE-2026-112260 |
high | 7.1 | 0.0016 | 2026-11-02 | A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can c | |
CVE-2026-112177 |
high | 7.3 | 0.0036 | 2026-11-02 | A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction | |
CVE-2026-112257 |
high | 7.8 | 0.0017 | 2026-11-02 | A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel | |
CVE-2026-106062 |
high | 7.8 | 0.0015 | 2026-11-02 | A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loa | |
CVE-2022-27779 |
medium | 5.3 | 0.0278 | 2026-11-02 | libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is p | |
CVE-2026-105604 |
critical | 9.3 | 0.0035 | 2026-11-02 | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3 | |
CVE-2026-105605 |
medium | 5.3 | 0.0029 | 2026-11-02 | Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access | |
CVE-2026-80185 |
medium | 5.7 | 0.0029 | 2026-11-02 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (lo |