Search
98,287 CVEs
CVEs (98,287, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 276–300 of 98,287 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-112202 | NONE | Patched | — | 2026-10-20 | Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are u… |
| CVE-2026-85783 | NONE | Patched | — | 2026-10-20 | Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key… |
| CVE-2026-113812 | NONE | Patched | — | 2026-10-20 | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root C… |
| CVE-2026-113212 | NONE | — | 2026-10-20 | Memory corruption in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2026-113196 | NONE | — | 2026-10-20 | Improper access control in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… | |
| CVE-2026-108518 | NONE | Patched | — | 2026-10-20 | DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} eleme… |
| CVE-2026-111879 | NONE | Patched | — | 2026-10-20 | DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's loc… |
| CVE-2025-60475 | NONE | Patched | — | 2026-10-20 | A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via sup… |
| CVE-2025-60494 | NONE | Patched | — | 2026-10-20 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servi… |
| CVE-2025-60496 | NONE | Patched | — | 2026-10-20 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service … |
| CVE-2026-94265 | NONE | — | 2026-10-20 | When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Nego… | |
| CVE-2026-94266 | NONE | — | 2026-10-20 | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl … | |
| CVE-2026-92386 | NONE | — | 2026-10-20 | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Conseque… | |
| CVE-2026-92387 | NONE | — | 2026-10-20 | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeo… | |
| CVE-2026-92388 | NONE | — | 2026-10-20 | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser… | |
| CVE-2026-92389 | NONE | — | 2026-10-20 | libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes inte… | |
| CVE-2026-92390 | NONE | — | 2026-10-20 | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the f… | |
| CVE-2026-92391 | NONE | — | 2026-10-20 | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth wi… | |
| CVE-2026-86415 | NONE | — | 2026-10-20 | libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a… | |
| CVE-2026-87861 | NONE | — | 2026-10-20 | When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origi… | |
| CVE-2026-87862 | NONE | — | 2026-10-20 | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS… | |
| CVE-2026-87863 | NONE | — | 2026-10-20 | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age … | |
| CVE-2026-87864 | NONE | — | 2026-10-20 | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads on… | |
| CVE-2026-87865 | NONE | — | 2026-10-20 | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `C… | |
| CVE-2026-87866 | NONE | — | 2026-10-20 | When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates th… |