Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
400,438 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-101374 | 5.9 Medium | Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to… | Oct 20, 2026 |
| CVE-2026-101373 | 2.4 Low | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST… | Oct 20, 2026 |
| CVE-2026-101372 | 3.7 Low | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… | Oct 20, 2026 |
| CVE-2026-101371 | 3.1 Low | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle… | Oct 20, 2026 |
| CVE-2026-101370 | 3.1 Low | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… | Oct 20, 2026 |
| CVE-2026-101369 | 6.1 Medium | Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to… | Oct 20, 2026 |
| CVE-2026-101368 | 5.4 Medium | Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to… | Oct 20, 2026 |
| CVE-2026-101367 | 5.4 Medium | Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST… | Oct 20, 2026 |
| CVE-2026-101366 | 4.3 Medium | Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST… | Oct 20, 2026 |
| CVE-2026-101365 | 4.7 Medium | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise… | Oct 20, 2026 |
| CVE-2026-101364 | 5.4 Medium | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise… | Oct 20, 2026 |
| CVE-2026-101363 | 5.3 Medium | Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… | Oct 20, 2026 |
| CVE-2026-101362 | 6.9 Medium | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… | Oct 20, 2026 |
| CVE-2026-101361 | 4.2 Medium | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST… | Oct 20, 2026 |
| CVE-2026-101360 | 5.4 Medium | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST… | Oct 20, 2026 |
| CVE-2026-101359 | 5.3 Medium | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST… | Oct 20, 2026 |
| CVE-2026-113729 | 7.5 High | Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization | Oct 20, 2026 |
| CVE-2026-113728 | 7.5 High | Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint | Oct 20, 2026 |
| CVE-2026-113727 | 7.4 High | OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs | Oct 20, 2026 |
| CVE-2026-113812 | 9.1 Critical | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates | Oct 20, 2026 |
| CVE-2026-113274 | 8.8 High | Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113039 | 8.8 High | Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113125 | 8.8 High | Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113013 | 8.8 High | Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113088 | 8.8 High | UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113083 | 8.8 High | Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-installed app. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113286 | 8.8 High | Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to leak sensitive information via a crafted HTML page.… | Oct 20, 2026 |
| CVE-2026-113227 | 8.8 High | Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113122 | 6.5 Medium | Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-112996 | 8.8 High | Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113294 | 8.8 High | Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113130 | 8.8 High | Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113074 | 8.8 High | Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113067 | 8.8 High | UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113046 | 8.8 High | UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113182 | 8.8 High | UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113331 | 8.8 High | Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113237 | 6.5 Medium | Race condition in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113314 | 8.8 High | Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-112994 | 8.8 High | UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113063 | 8.8 High | Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113254 | 8.8 High | Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113169 | 9.6 Critical | UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113132 | 8.8 High | Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113287 | 8.8 High | Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113121 | 8.8 High | Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113066 | 6.5 Medium | Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113107 | 8.8 High | Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity:… | Oct 20, 2026 |
| CVE-2026-113085 | 8.8 High | Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
| CVE-2026-113288 | 8.8 High | Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.