Export limit exceeded: 408827 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408827 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70177 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 7.8 High |
| Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70176 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7 High |
| Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70173 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-70166 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-13 | 6.5 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-70566 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 7.8 High |
| Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-72968 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7 High |
| Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96183 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-10-13 | 5.5 Medium |
| Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-109772 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-102599 | 2026-10-13 | 7.5 High | ||
| Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10. | ||||
| CVE-2026-79608 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.html | ||||
| CVE-2026-84790 | 2026-10-13 | N/A | ||
| OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | ||||
| CVE-2026-109780 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-110247 | 1 Mozilla | 1 Thunderbird | 2026-10-13 | 8.8 High |
| Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158. | ||||
| CVE-2026-88763 | 1 Redhat | 1 Service Interconnect | 2026-10-13 | 5.9 Medium |
| A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network. | ||||
| CVE-2026-109768 | 1 Mozilla | 1 Firefox | 2026-10-13 | 6.5 Medium |
| Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-109769 | 1 Mozilla | 1 Firefox | 2026-10-13 | 4.3 Medium |
| Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-109770 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-84320 | 1 0xjacky | 1 Nginx-ui | 2026-10-13 | 6.3 Medium |
| Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3. | ||||
| CVE-2026-84319 | 1 0xjacky | 1 Nginx-ui | 2026-10-13 | 8.3 High |
| Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1. | ||||
| CVE-2026-82416 | 1 Php | 1 Frankenphp | 2026-10-13 | 7.7 High |
| FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5. | ||||