Export limit exceeded: 425468 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425468 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119951 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-12 | 8.1 High |
| Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119954 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-12 | 7.8 High |
| Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-118713 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118717 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118722 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-126643 | 1 Redhat | 1 Ansible Automation Platform | 2026-11-12 | 6.5 Medium |
| A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs. | ||||
| CVE-2026-119826 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-11-12 | 7.8 High |
| Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119829 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 6.8 Medium |
| Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-119833 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7 High |
| Untrusted pointer dereference in Windows Message Queuing allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119835 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7 High |
| Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119841 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-12 | 4.7 Medium |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-119890 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-12 | 5.3 Medium |
| Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-119893 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-11-12 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119905 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-12 | 4.9 Medium |
| Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-119900 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.3 High |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119908 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-11-12 | 8.8 High |
| Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-124704 | 2026-11-12 | 7.8 High | ||
| In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application. | ||||
| CVE-2026-124703 | 2026-11-12 | 7.8 High | ||
| In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application. | ||||
| CVE-2026-55655 | 3 Openbsd, Openssh, Redhat | 15 Openssh, Openssh, Enterprise Linux and 12 more | 2026-11-12 | 5 Medium |
| A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session. | ||||
| CVE-2026-55653 | 3 Openbsd, Openssh, Redhat | 15 Openssh, Openssh, Enterprise Linux and 12 more | 2026-11-12 | 4.3 Medium |
| A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS). | ||||