WaratekVRT Sign in
Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 23,372 matches · 52 in Waratek scope · 7 protected · 7 exploited · 0 CISA KEV · 134 public PoC · 0 EPSS ≥ 0.5
23,372matches 52in Waratek scope0.2% 7protected0.0% 7exploited0.0% 0CISA KEV0.0% 134public PoC0.6% 0EPSS ≥ 0.50.0%
Protected by Waratek 7 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 45 0.2% Outside Waratek scope 0 0.0% Not applicable 4,148 17.7% Withdrawn CVE 19,172 82.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 23,372 100.0%
blocked by ARMR today 7 0.0% partly blocked 0 0.0% not blocked 23,365 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 0.0% Working exploit published 118 0.5% Proof of concept only 14 0.1% Forecast only 0 0.0% No public exploit 23,233 99.4%
split by peak 6,064 / year
Withdrawn CVE: 19,172Not applicable: 4,148No exploit published: 45Protected by Waratek: 7 Unknown: 23,372 not blocked: 23,365blocked by ARMR today: 7 No public exploit: 23,233Proof of concept only: 14Working exploit published: 118Exploited: 7
19921 Withdrawn CVE1 Unknown1 not blocked1 No public exploit1 19930 19941 Withdrawn CVE1 Unknown1 not blocked1 No public exploit1 19950 19961 Withdrawn CVE1 Unknown1 not blocked1 Working exploit published1 19971 Withdrawn CVE1 Unknown1 not blocked1 No public exploit1 19981 Withdrawn CVE1 Unknown1 not blocked1 No public exploit1 199929 Withdrawn CVE29 Unknown29 not blocked29 Working exploit published1 No public exploit28 20001 Withdrawn CVE1 Unknown1 not blocked1 No public exploit1 20013 Withdrawn CVE3 Unknown3 not blocked3 No public exploit3 200214 Withdrawn CVE14 Unknown14 not blocked14 Working exploit published2 No public exploit12 200321 Withdrawn CVE21 Unknown21 not blocked21 Working exploit published1 No public exploit20 200428 Withdrawn CVE28 Unknown28 not blocked28 No public exploit28 200578 Withdrawn CVE78 Unknown78 not blocked78 Working exploit published5 No public exploit73 200651 Withdrawn CVE51 Unknown51 not blocked51 Working exploit published3 No public exploit48 200780 Withdrawn CVE80 Unknown80 not blocked80 Working exploit published3 No public exploit77 200832 Withdrawn CVE32 Unknown32 not blocked32 Working exploit published5 No public exploit27 200946 Withdrawn CVE46 Unknown46 not blocked46 Working exploit published6 No public exploit40 201028 Withdrawn CVE28 Unknown28 not blocked28 Working exploit published2 No public exploit26 201122 Withdrawn CVE22 Unknown22 not blocked22 Working exploit published3 No public exploit19 201263 Withdrawn CVE63 Unknown63 not blocked63 Working exploit published5 No public exploit58 2013137 Withdrawn CVE137 Unknown137 not blocked137 Working exploit published20 No public exploit117 201480 Withdrawn CVE80 Unknown80 not blocked80 Working exploit published11 No public exploit69 2015101 Withdrawn CVE101 Unknown101 not blocked101 Working exploit published5 No public exploit96 201668 Withdrawn CVE68 Unknown68 not blocked68 Working exploit published4 No public exploit64 20173,471 Withdrawn CVE3,471 Unknown3,471 not blocked3,471 Exploited1 Working exploit published10 No public exploit3,460 20181,644 Withdrawn CVE1,644 Unknown1,644 not blocked1,644 Working exploit published5 Proof of concept only1 No public exploit1,638 20191,633 Withdrawn CVE1,633 Unknown1,633 not blocked1,633 Exploited1 Working exploit published3 No public exploit1,629 2020900 Withdrawn CVE900 Unknown900 not blocked900 Working exploit published5 No public exploit895 20211,801 Withdrawn CVE1,801 Unknown1,801 not blocked1,801 Working exploit published1 No public exploit1,800 20221,360 Not applicable2 Withdrawn CVE1,358 Unknown1,360 not blocked1,360 Working exploit published4 Proof of concept only6 No public exploit1,350 20232,134 Not applicable1 Withdrawn CVE2,133 Unknown2,134 not blocked2,134 Exploited1 Working exploit published6 Proof of concept only1 No public exploit2,126 2024759 Protected by Waratek1 Not applicable7 Withdrawn CVE751 Unknown759 blocked by ARMR today1 not blocked758 Exploited1 Working exploit published4 Proof of concept only1 No public exploit753 20252,719 Not applicable897 Withdrawn CVE1,822 Unknown2,719 not blocked2,719 Exploited2 Working exploit published3 Proof of concept only2 No public exploit2,712 20266,064 Protected by Waratek6 No exploit published45 Not applicable3,241 Withdrawn CVE2,772 Unknown6,064 blocked by ARMR today6 not blocked6,058 Exploited1 Proof of concept only3 No public exploit6,060
199319961999200220052008201120142017202020232026
23,372 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 234 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-97872 Unknown 2026-11-10 No exploit published No public exploit When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module with such settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
CVE-2026-97870 Unknown 2026-11-10 No exploit published No public exploit When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
CVE-2026-97867 Unknown 2026-11-10 No exploit published No public exploit The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-97849 Unknown 2026-11-10 No exploit published No public exploit The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-95692 Unknown 2026-11-10 Not applicable No public exploit Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected. Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV. CWE: CWE-125: Out-of-bounds Read Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length. The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery. Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application. FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm.
CVE-2026-95691 Unknown 2026-11-10 Not applicable No public exploit Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free. Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response. CWE: CWE-416: Use After Free Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues. The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
CVE-2026-88823 Unknown 2026-11-10 Not applicable No public exploit Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary.
CVE-2026-88822 Unknown 2026-11-10 Not applicable No public exploit Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets. Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic. CWE: CWE-457 (Use of Uninitialized Variable) Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake. This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module.
CVE-2026-87758 Unknown 2026-11-10 No exploit published No public exploit The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-87756 Unknown 2026-11-10 No exploit published No public exploit The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-87755 Unknown 2026-11-10 No exploit published No public exploit Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-86811 Unknown 2026-11-10 Protected by Waratek No public exploit The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-86532 Unknown 2026-11-10 No exploit published No public exploit The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-86531 Unknown 2026-11-10 No exploit published No public exploit The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
CVE-2026-86336 Unknown 2026-11-10 No exploit published No public exploit Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
CVE-2026-59630 Unknown 2026-11-10 Not applicable No public exploit In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59618 Unknown 2026-11-10 Not applicable No public exploit In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59614 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59609 Unknown 2026-11-10 Not applicable No public exploit In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59607 Unknown 2026-11-10 Not applicable No public exploit In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-59606 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59604 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59601 Unknown 2026-11-10 Not applicable No public exploit In CalculateSampleRate of cldma_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59599 Unknown 2026-11-10 Withdrawn CVE No public exploit Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-59598 Unknown 2026-11-10 Not applicable No public exploit In platform_rio_ncp_wdt_handler of edgetpu_rio.c, there is a possible Use After Free due to a use after free. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-59597 Unknown 2026-11-10 Not applicable No public exploit In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissions across configuration updates due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59586 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59583 Unknown 2026-11-10 Not applicable No public exploit In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59580 Unknown 2026-11-10 Not applicable No public exploit In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.
CVE-2026-59579 Unknown 2026-11-10 Not applicable No public exploit In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-59575 Unknown 2026-11-10 Not applicable No public exploit In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59574 Unknown 2026-11-10 Not applicable No public exploit In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware log notifications due to an incorrect bounds check. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58812 Unknown 2026-11-10 Not applicable No public exploit In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.
CVE-2026-58811 Unknown 2026-11-10 Not applicable No public exploit In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58810 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58808 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58806 Unknown 2026-11-10 Not applicable No public exploit In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.
CVE-2026-58805 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58803 Unknown 2026-11-10 Not applicable No public exploit In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58801 Unknown 2026-11-10 Not applicable No public exploit In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream identifiers due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58800 Unknown 2026-11-10 Not applicable No public exploit In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58799 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58798 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of cn_Tai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58797 Unknown 2026-11-10 Not applicable No public exploit In register_dump_dpa of sswrp_pcie.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.
CVE-2026-58796 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58787 Unknown 2026-11-10 Not applicable No public exploit In chppWifiRangingEventNotification of clients/wifi.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-58783 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58782 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58780 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58779 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58769 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58762 Unknown 2026-11-10 Not applicable No public exploit In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58752 Unknown 2026-11-10 Not applicable No public exploit In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58740 Unknown 2026-11-10 Not applicable No public exploit In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58736 Unknown 2026-11-10 Not applicable No public exploit In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58722 Unknown 2026-11-10 Not applicable No public exploit In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58702 Unknown 2026-11-10 Not applicable No public exploit In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58684 Unknown 2026-11-10 Not applicable No public exploit In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58681 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58680 Unknown 2026-11-10 Not applicable No public exploit In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-57048 Unknown 2026-11-10 Not applicable No public exploit In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-57047 Unknown 2026-11-10 Not applicable No public exploit In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-57043 Unknown 2026-11-10 Not applicable No public exploit In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-57036 Unknown 2026-11-10 Not applicable No public exploit In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-57010 Unknown 2026-11-10 Not applicable No public exploit In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-57009 Unknown 2026-11-10 Not applicable No public exploit In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-57005 Unknown 2026-11-10 Not applicable No public exploit In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-57004 Unknown 2026-11-10 Not applicable No public exploit In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56971 Unknown 2026-11-10 Not applicable No public exploit In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56969 Unknown 2026-11-10 Not applicable No public exploit In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-56956 Unknown 2026-11-10 Not applicable No public exploit In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56947 Unknown 2026-11-10 Not applicable No public exploit In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56946 Unknown 2026-11-10 Not applicable No public exploit In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56944 Unknown 2026-11-10 Not applicable No public exploit In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56943 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56938 Unknown 2026-11-10 Not applicable No public exploit In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-56935 Unknown 2026-11-10 Not applicable No public exploit In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56934 Unknown 2026-11-10 Not applicable No public exploit In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56929 Unknown 2026-11-10 Not applicable No public exploit In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-56926 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56919 Unknown 2026-11-10 Not applicable No public exploit In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-56916 Unknown 2026-11-10 Not applicable No public exploit In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-56912 Unknown 2026-11-10 Not applicable No public exploit In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
CVE-2026-56909 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56902 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56898 Unknown 2026-11-10 Not applicable No public exploit In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56897 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55362 Unknown 2026-11-10 Not applicable No public exploit In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55360 Unknown 2026-11-10 Not applicable No public exploit In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55348 Unknown 2026-11-10 Not applicable No public exploit In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55335 Unknown 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55319 Unknown 2026-11-10 Not applicable No public exploit In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55316 Unknown 2026-11-10 Not applicable No public exploit In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55311 Unknown 2026-11-10 Not applicable No public exploit In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55309 Unknown 2026-11-10 Not applicable No public exploit In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-14447 Unknown 2026-11-10 Not applicable No public exploit In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-126136 Unknown 2026-11-10 Not applicable No public exploit For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
CVE-2026-126135 Unknown 2026-11-10 Not applicable No public exploit If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
CVE-2026-126134 Unknown 2026-11-10 Not applicable No public exploit Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
CVE-2026-126133 Unknown 2026-11-10 Not applicable No public exploit When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
‹ prev page 2 of 234 next ›