Export limit exceeded: 414020 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10082 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 414020 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (414020 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-88190 1 Microsoft 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more 2026-10-24 6.5 Medium
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-97756 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-10-24 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-102188 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-24 6.8 Medium
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-96243 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-24 7.8 High
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
CVE-2026-96944 1 Microsoft 11 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 8 more 2026-10-24 5.5 Medium
Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.
CVE-2026-103558 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-24 7.5 High
Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
CVE-2026-111216 2 Netgate, Pfsense 3 Pfsense, Pfsense Ce, Pfsense 2026-10-24 7.2 High
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
CVE-2026-95943 1 Microsoft 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more 2026-10-24 7 High
Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-115998 1 Cervantessec 1 Cervantes 2026-10-24 4.3 Medium
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
CVE-2026-100220 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-24 8.8 High
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
CVE-2026-69506 1 Microsoft 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more 2026-10-24 4.7 Medium
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
CVE-2026-100225 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-24 7 High
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-102191 1 Microsoft 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more 2026-10-24 7 High
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-115994 1 Cervantessec 1 Cervantes 2026-10-24 5.4 Medium
BOLA Allows Cross-Project Target Tampering  in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
CVE-2026-102198 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-24 5.3 Medium
Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.
CVE-2026-102205 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-24 7.8 High
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-106623 1 Adobe 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 2026-10-24 7.5 High
ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
CVE-2026-105901 1 Adobe 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 2026-10-24 8.8 High
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-18548 2 Trainingbusinesspros, Wordpress-extensions 2 Groundhogg — Crm, Newsletters, And Marketing Automation, Groundhogg 2026-10-24 7.2 High
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-62439 3 Gnome, Red Hat, Redhat 3 Gimp, Enterprise Linux, Enterprise Linux 2026-10-24 7 High
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.