Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7,575

Export CSV
CVE-2026-103826

Substance3D - Designer | NULL Pointer Dereference (CWE-476)

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Substance 3d Designer Macos Windows
CVE-2026-103827

Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)

Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Substance 3d Designer Macos Windows
CVE-2026-103828

Substance3D - Designer | NULL Pointer Dereference (CWE-476)

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Substance 3d Designer Macos Windows
CVE-2026-103829

Substance3D - Designer | NULL Pointer Dereference (CWE-476)

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Substance 3d Designer Macos Windows
CVE-2026-91800

Foxit PDF Editor installer local privilege escalation

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Foxit Foxitsoftware
Products
Macos Pdf Editor Pdf Reader and 1 more
CVE-2026-91807

Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Foxit Foxitsoftware and 1 more
Products
Macos Pdf Editor Pdf Reader and 3 more
CVE-2026-91811

Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Foxit Foxitsoftware and 1 more
Products
Macos Pdf Editor Pdf Reader and 3 more
CVE-2024-2466

TLS certificate check bypass with mbedTLS

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Curl Haxx and 2 more
Products
Macos Libcurl Curl and 11 more
CVE-2024-2398

HTTP/2 push headers memory-leak

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

CVSS 3.1 · 8.6 High EPSS 36.1% KEV · Not listed
Vendors
Apple Curl Fedoraproject and 3 more
Products
Macos Curl Fedora and 24 more
CVE-2024-2379

QUIC certificate check bypass with wolfSSL

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

CVSS 3.1 · 6.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Active Iq Unified Manager and 18 more
CVE-2024-2004

Usage of disabled protocol

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.

CVSS 3.1 · 3.5 Low EPSS 1.7% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 2 more
Products
Macos Fedora Curl and 13 more
CVE-2022-43552

curl: Use-after-free triggered by an HTTP proxy deny response

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

CVSS 3.1 · 5.9 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Haxx Redhat and 1 more
Products
Macos Curl Enterprise Linux and 3 more
CVE-2022-42916

curl: HSTS bypass via IDN

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 2 more
Products
Macos Fedora Curl and 2 more
CVE-2022-42915

curl: HTTP proxy double-free

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 3 more
Products
Macos Fedora Curl and 11 more
CVE-2022-40304

libxml2: dict corruption caused by entity reference cycles

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1 · 7.8 High EPSS 5.8% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-35260

curl: .netrc parser out-of-bounds access

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Clustered Data Ontap and 9 more
CVE-2022-35252

curl: Incorrect handling of control code characters in cookies

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CVSS 3.1 · 3.7 Low EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 18 more
CVE-2026-110156

chromium-browser: Incorrect reference resolution in Extensions

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome