Export limit exceeded: 425866 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425866 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425866 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96978 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95974 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95976 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-11-14 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96029 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96037 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows User Manager Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96035 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96139 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96157 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-112752 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Improper access control in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-129260 | 1 Mereithhh | 1 Vanblog | 2026-11-14 | 6.6 Medium |
| A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised. | ||||
| CVE-2026-120687 | 2026-11-14 | 7.2 High | ||
| The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users when bbPress is installed, as its bbp_filter_kses filter chain permits img and pre tags while preserving numeric character references inside attribute values, allowing encoded payloads to bypass save-time sanitization and reach the vulnerable sink fully intact. Exploitation by attackers with subscriber-level access and above requires that bbPress 2.6.20 is installed, a public forum exists, and either the first topic has already been approved or subsequent topics clear moderation. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above. | ||||
| CVE-2026-96981 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 6.4 Medium |
| Out-of-bounds write in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-96976 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 4.9 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-96970 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 4.9 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-96972 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-96986 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 4.9 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-96987 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 4.9 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-96988 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 4.9 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-72998 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 8.1 High |
| Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85907 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 4.4 Medium |
| Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally. | ||||