Export limit exceeded: 408467 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408467 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97823 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97822 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97821 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97820 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97765 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2021 and 5 more | 2026-10-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-9268 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 2.7 Low |
| GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks. | ||||
| CVE-2026-92883 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 8.7 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output. | ||||
| CVE-2026-92528 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 4.2 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution. | ||||
| CVE-2026-89201 | 1 Siemens | 1 Ruggedcom Crossbow | 2026-10-14 | 7.5 High |
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. | ||||
| CVE-2026-89196 | 1 Siemens | 1 Ruggedcom Crossbow | 2026-10-14 | 8.8 High |
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. | ||||
| CVE-2026-89111 | 1 Sap Se | 1 Sap Cloud | 2026-10-14 | 10 Critical |
| The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. | ||||
| CVE-2026-86848 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-10-14 | 8.8 High |
| A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend. | ||||
| CVE-2026-86566 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-10-14 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. | ||||
| CVE-2026-85529 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API. | ||||
| CVE-2026-84284 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks. | ||||
| CVE-2026-82153 | 2026-10-14 | 2.2 Low | ||
| Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure. | ||||
| CVE-2026-78802 | 2026-10-14 | 9.8 Critical | ||
| An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. | ||||
| CVE-2026-78628 | 2026-10-14 | 6 Medium | ||
| The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs. | ||||
| CVE-2026-77371 | 2026-10-14 | N/A | ||
| Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0. | ||||
| CVE-2026-73252 | 2026-10-14 | 7.5 High | ||
| Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23. | ||||