Export limit exceeded: 98449 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (98449 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-28636 1 Google 1 Android 2026-09-11 7.8 High
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28668 1 Google 1 Android 2026-09-11 7.8 High
In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-45528 1 Google 1 Android 2026-09-11 7.3 High
In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-49881 1 Google 1 Android 2026-09-11 7.8 High
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-21087 2 Samsung, Samsung Mobile 2 Android, Samsung Mobile Devices 2026-09-11 7.8 High
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
CVE-2026-21089 2 Samsung, Samsung Mobile 2 Android, Samsung Mobile Devices 2026-09-11 7.8 High
Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-28631 1 Google 1 Android 2026-09-10 7.8 High
In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28644 1 Google 1 Android 2026-09-10 7.8 High
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28650 1 Google 1 Android 2026-09-10 7.8 High
In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28657 1 Google 1 Android 2026-09-10 7.8 High
In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28658 1 Google 1 Android 2026-09-10 7.8 High
In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-71613 1 Gpac 1 Gpac 2026-09-10 7.8 High
Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859.
CVE-2026-69814 1 Microsoft 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more 2026-09-10 7 High
Use after free in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
CVE-2026-69791 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-09-10 7 High
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69498 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-09-10 7 High
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-67639 1 Microsoft 11 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 8 more 2026-09-10 8.8 High
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67638 1 Microsoft 3 Microsoft Sql Server 2025 (cu 2), Microsoft Sql Server 2025 For X64-based Systems (gdr), Sql Server 2025 2026-09-10 8.8 High
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-68835 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-10 7.1 High
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
CVE-2026-67368 1 Microsoft 4 Sql Server 2017, Sql Server 2019, Sql Server 2022 and 1 more 2026-09-10 8.8 High
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62895 1 Microsoft 1 Azure Arc Sql Server Extension 2026-09-10 8.8 High
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.