Export limit exceeded: 408574 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408574 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70198 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-13 | 7 High |
| Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70177 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 7.8 High |
| Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70176 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7 High |
| Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70173 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-70166 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-13 | 6.5 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-70566 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 7.8 High |
| Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-72968 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7 High |
| Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96183 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-10-13 | 5.5 Medium |
| Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-109772 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-102599 | 2026-10-13 | 7.5 High | ||
| Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10. | ||||
| CVE-2026-79608 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.html | ||||
| CVE-2026-84790 | 2026-10-13 | N/A | ||
| OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | ||||
| CVE-2026-109780 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-110247 | 1 Mozilla | 1 Thunderbird | 2026-10-13 | 8.8 High |
| Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158. | ||||
| CVE-2026-88763 | 1 Redhat | 1 Service Interconnect | 2026-10-13 | 5.9 Medium |
| A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on recursion during parsing, the router can run out of stack memory and crash, leading to a denial of service for the interconnected network. | ||||
| CVE-2026-109768 | 1 Mozilla | 1 Firefox | 2026-10-13 | 6.5 Medium |
| Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-109769 | 1 Mozilla | 1 Firefox | 2026-10-13 | 4.3 Medium |
| Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-109770 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-100119 | 2026-10-13 | 7.5 High | ||
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-100114 | 2026-10-13 | 7.5 High | ||
| CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. | ||||