Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt

Hoch 7.4Linux-Server

actionpack: actionpack: IP address spoofing via crafted Forwarded header

CVE-2026-126083actionpack10. Nov 2026

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client…

Original bei Red HatAlle Quellen (3)

Hoch 7.5Linux-Server

activesupport: Active Support: Denial of Service via unescaped regular expressions in safe_constantize

CVE-2026-126080activesupport10. Nov 2026

### Impact When constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests…

Original bei Red HatAlle Quellen (3)

Hoch 7.2Software

A vulnerability exists in a system component that may, under certain conditions, allow an authorized user to make unauthorized changes to system-managed…

CVE-2026-9578510. Nov 2026

A vulnerability exists in a system component that may, under certain conditions, allow an authorized user to make unauthorized changes to system-managed content. Successful exploitation could affect system confidentiality, integrity, and availability, and may disrupt trusted interactions among system functions.

Original bei NVDAlle Quellen (1)

Hoch 7.5Software

A vulnerability exists in a system component that may, under certain conditions, disrupt the availability of affected services.

CVE-2026-9578410. Nov 2026

A vulnerability exists in a system component that may, under certain conditions, disrupt the availability of affected services. Successful exploitation could result in temporary service interruption or loss of functionality.

Original bei NVDAlle Quellen (1)

Hoch 7.5Software

A vulnerability exists in a network-facing component that may, under certain conditions, result in service disruption.

CVE-2026-9578310. Nov 2026

A vulnerability exists in a network-facing component that may, under certain conditions, result in service disruption. Successful exploitation could cause temporary unavailability of affected functionality.

Original bei NVDAlle Quellen (1)

Hoch 7.5Software

A vulnerability exists in a monitoring component that may, under certain conditions, allow security controls to be circumvented.

CVE-2026-9578210. Nov 2026

A vulnerability exists in a monitoring component that may, under certain conditions, allow security controls to be circumvented. Successful exploitation could result in unauthorized access to information intended for authorized users only.

Original bei NVDAlle Quellen (1)

Hoch 7.5Software

A security vulnerability exists in AthonetOS that may allow an unauthorized party to affect service operation or gain access to certain protected system…

CVE-2026-9578110. Nov 2026

A security vulnerability exists in AthonetOS that may allow an unauthorized party to affect service operation or gain access to certain protected system functions. Successful exploitation could result in a compromise of service integrity or unauthorized system access.

Original bei NVDAlle Quellen (1)

Hoch 8.1Software

A vulnerability exists in the authentication and session-management mechanisms that may result in access not being fully terminated following certain account…

CVE-2026-9578010. Nov 2026

A vulnerability exists in the authentication and session-management mechanisms that may result in access not being fully terminated following certain account or session state changes. Under specific conditions, a remote user with prior legitimate access could retain access to protected system resources beyond the intended authorization period. Successful exploitation could result in continued unauthorized access.

Original bei NVDAlle Quellen (1)

Hoch 8.4Android

In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check.

CVE-2026-9540510. Nov 2026

In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check.

CVE-2026-9540310. Nov 2026

In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-9540210. Nov 2026

In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-9540110. Nov 2026

In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check.

CVE-2026-9540010. Nov 2026

In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-9539710. Nov 2026

In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5963510. Nov 2026

In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5963110. Nov 2026

In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5961610. Nov 2026

In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5961210. Nov 2026

In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5960810. Nov 2026

In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value.

CVE-2026-5959610. Nov 2026

In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In spm_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow.

CVE-2026-5959410. Nov 2026

In spm_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow.

CVE-2026-5959310. Nov 2026

In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In s_av1_dec_metadata_scalability of av1_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5958910. Nov 2026

In s_av1_dec_metadata_scalability of av1_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of bounds write into global memory due to…

CVE-2026-5958710. Nov 2026

In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of bounds write into global memory due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5957810. Nov 2026

In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5957310. Nov 2026

In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to an…

CVE-2026-5880410. Nov 2026

In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5879110. Nov 2026

In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In CMD_ENC_SET_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5879010. Nov 2026

In CMD_ENC_SET_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In stpropnci_process_std of stpropnci_std.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check.

CVE-2026-5878810. Nov 2026

In stpropnci_process_std of stpropnci_std.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)