Export limit exceeded: 412418 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 412418 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 412418 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (412418 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-109712 1 Mozilla 1 Firefox 2026-10-17 7.1 High
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-85858 1 Microsoft 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more 2026-10-17 7.8 High
Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVE-2026-85859 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-17 6.5 Medium
Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.
CVE-2026-96314 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-17 5.5 Medium
Out-of-bounds read in Windows Audio Service allows an authorized attacker to disclose information locally.
CVE-2026-96310 1 Microsoft 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more 2026-10-17 7 High
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-93485 1 Automattic 1 Wordpress 2026-10-17 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
CVE-2026-103500 1 Mozilla 1 Thunderbird 2026-10-17 6.3 Medium
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
CVE-2026-109774 1 Mozilla 1 Firefox 2026-10-17 N/A
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-85861 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-17 7.8 High
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85863 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-17 7.8 High
Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96306 1 Microsoft 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more 2026-10-17 7.8 High
Out-of-bounds read in Windows Sysmain Service allows an authorized attacker to elevate privileges locally.
CVE-2026-109763 1 Mozilla 2 Firefox, Thunderbird 2026-10-17 N/A
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-108457 1 Microsoft 9 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 6 more 2026-10-17 8.1 High
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
CVE-2026-108462 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-17 5.5 Medium
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-108460 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-17 8.1 High
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
CVE-2026-106098 1 Wordpress-extensions 1 Wp Data Access 2026-10-17 5.3 Medium
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
CVE-2026-109118 1 Ikus-soft 1 Rdiffweb 2026-10-17 4.6 Medium
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed
CVE-2026-109119 1 Ikus-soft 1 Rdiffweb 2026-10-17 8.8 High
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
CVE-2024-34321 2026-10-17 6.1 Medium
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.
CVE-2026-95115 1 Warmcat 1 Libwebsockets 2026-10-17 7.5 High
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser