Export limit exceeded: 410586 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410586 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410586 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-21123 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-17 | N/A |
| Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock. | ||||
| CVE-2026-95127 | 2026-10-17 | N/A | ||
| An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | ||||
| CVE-2026-103316 | 1 Logius | 1 Digid For Macos | 2026-10-17 | 7.1 High |
| The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy) | ||||
| CVE-2026-109712 | 1 Mozilla | 1 Firefox | 2026-10-17 | 7.1 High |
| Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-85858 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-17 | 7.8 High |
| Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85859 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 6.5 Medium |
| Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-96314 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96310 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-17 | 7 High |
| Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-93485 | 1 Automattic | 1 Wordpress | 2026-10-17 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1. | ||||
| CVE-2026-103500 | 1 Mozilla | 1 Thunderbird | 2026-10-17 | 6.3 Medium |
| An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. | ||||
| CVE-2026-109774 | 1 Mozilla | 1 Firefox | 2026-10-17 | N/A |
| Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-85861 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-17 | 7.8 High |
| Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85863 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-17 | 7.8 High |
| Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96306 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-10-17 | 7.8 High |
| Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-109763 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-17 | N/A |
| Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-108457 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-10-17 | 8.1 High |
| Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108462 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-108460 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 8.1 High |
| Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-106098 | 1 Wordpress-extensions | 1 Wp Data Access | 2026-10-17 | 5.3 Medium |
| The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator. | ||||
| CVE-2026-109118 | 1 Ikus-soft | 1 Rdiffweb | 2026-10-17 | 4.6 Medium |
| Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed | ||||