Export limit exceeded: 425866 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425866 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96084 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Graphic Fonts allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96041 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96060 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96067 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 9.8 Critical |
| Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96086 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 6.5 Medium |
| Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network. | ||||
| CVE-2026-96093 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 4.7 Medium |
| Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-120788 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-129261 | 1 Kingston | 1 Fury Ctrl Rgb Control Software | 2026-11-14 | 8.2 High |
| A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioctl with insufficient access control. The attack is only possible with local access. | ||||
| CVE-2026-126640 | 1 Wordpress-extensions | 1 Wp Ultimate Csv Importer | 2026-11-14 | N/A |
| The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks. | ||||
| CVE-2026-96112 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 5.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96115 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-11-14 | 8 High |
| Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-96129 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-11-14 | 7.8 High |
| Inclusion of functionality from untrusted control sphere in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96134 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96150 | 1 Microsoft | 24 Office, Windows 10 1607, Windows 10 1809 and 21 more | 2026-11-14 | 5.6 Medium |
| Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96158 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-129258 | 1 Tenda | 2 Ac18, Ac18 Firmware | 2026-11-14 | 9.1 Critical |
| A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-126639 | 2026-11-14 | N/A | ||
| The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content. | ||||
| CVE-2026-126697 | 2026-11-14 | N/A | ||
| The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to sites, allowing the attacker controlling that server to inject arbitrary content into pages and to deliver arbitrary code to affected sites. Version 5.2.1, as published on WordPress.org, bundled the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker library (updater/ directory) configured to poll https://anadnet.com/updates/?action=get_metadata&slug=quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4. In March 2021 that server delivered a modified 5.2.3 build, different from the 5.2.3 later published on WordPress.org, which kept the update channel and added a the_content filter that, for logged-out visitors on single posts and pages, fetched content from https://w.anadnet.com/bro/3/ (passing the site host, request URI and visitor User-Agent) and prepended the response to the post (observed serving SEO spam links to search engine crawlers). Because the version string matched a later WordPress.org release, affected sites were not offered a clean update until 5.2.4. Indicators of compromise: - Outbound requests to anadnet.com or w.anadnet.com - An updater/ directory (Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 Update Checker, Puc v4p10) inside wp-content/Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4/quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4/ - The strings filter_the_content_in_the_main_loop, ppr_pro, QQQEND or w.anadnet.com in page_post_redirect_Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4.php - page_post_redirect_Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4.php with MD5 ad717da18cf8a2b69899c0d7dafee05a (tampered 5.2.3) Remediation: remove the Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 (it has been closed on WordPress.org), or at minimum reinstall the clean 5.2.4 from WordPress.org, delete any leftover updater/ directory, verify the files with "wp Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 verify-checksums quick-pagepost-redirect-Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4", clear the opcode cache, and treat any site that ran the tampered build as potentially compromised. | ||||
| CVE-2026-96177 | 1 Microsoft | 2 Windows Server 2025, Windows Server 2025 (server Core Installation) | 2026-11-14 | 8.1 High |
| Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96179 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 6.7 Medium |
| Use after free in DNS Server allows an authorized attacker to elevate privileges locally. | ||||