Export limit exceeded: 423522 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423522 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108417 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-11-10 | 6.5 Medium |
| Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108409 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-100204 | 1 Microsoft | 1 Heif Image Extension | 2026-11-10 | 7 High |
| Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-105590 | 1 Microsoft | 4 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 1 more | 2026-11-10 | 5.3 Medium |
| Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-105589 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7 High |
| Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105588 | 1 Microsoft | 4 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 1 more | 2026-11-10 | 6.4 Medium |
| Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105587 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7 High |
| Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105586 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7 High |
| Null pointer dereference in Microsoft Windows SCSI Class System File allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105584 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-11-10 | 5.5 Medium |
| Use of externally-controlled format string in Windows Inventory Backup allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-105583 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-11-10 | 7 High |
| Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105582 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-11-10 | 7 High |
| Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102868 | 1 Microsoft | 4 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 1 more | 2026-11-10 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-6245 | 2 Fedoraproject, Redhat | 5 Sssd, Enterprise Linux, Openshift and 2 more | 2026-11-10 | 5.5 Medium |
| A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS). | ||||
| CVE-2026-107496 | 2026-11-10 | N/A | ||
| Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service. CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns. The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop. OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option. The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected. The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely. FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached. | ||||
| CVE-2026-120734 | 1 Devolutions | 2 Devolutions Server, Server | 2026-11-10 | 6.5 Medium |
| Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host. | ||||
| CVE-2026-120733 | 1 Devolutions | 2 Devolutions Server, Server | 2026-11-10 | 7.5 High |
| Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user. | ||||
| CVE-2026-120716 | 1 Devolutions | 2 Devolutions Server, Server | 2026-11-10 | 6.5 Medium |
| Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response. | ||||
| CVE-2026-120715 | 1 Devolutions | 2 Devolutions Server, Server | 2026-11-10 | 8.1 High |
| Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request. | ||||
| CVE-2026-119636 | 1 Devolutions | 2 Devolutions Server, Server | 2026-11-10 | 8.8 High |
| Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated. | ||||
| CVE-2026-122146 | 1 101arrowz | 1 Fflate | 2026-11-10 | 5.3 Medium |
| A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. It is suggested to update the configuration settings. The maintainer disputes this issue as a vulnerability. The library is a pure JavaScript decompressor that allocates memory proportional to the decompressed payload size, which is expected behavior. Excessive allocations simply throw a standard JavaScript RangeError or reach engine heap limits. Furthermore, because a low-level decompression library cannot distinguish between a maliciously crafted compression bomb and a legitimate file with a high compression ratio, the API explicitly provides a filter option allowing callers to restrict decompressed file sizes and prevent denial-of-service according to their application's requirements, as seen both in the documentation and noted in the reported issue. | ||||