Export limit exceeded: 395734 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395734 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69890 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-16 | 7.5 High |
| Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69889 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-16 | 7 High |
| Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69881 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-16 | 7.5 High |
| Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69874 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-16 | 8.2 High |
| Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-64714 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-09-16 | 5.5 Medium |
| A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously crafted image may lead to a denial-of-service. | ||||
| CVE-2026-69866 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-16 | 7 High |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-81910 | 1 Concretecms | 1 Concrete Cms | 2026-09-16 | 6.5 Medium |
| Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting. | ||||
| CVE-2026-69864 | 1 Microsoft | 12 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 9 more | 2026-09-16 | 7.8 High |
| Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69862 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-09-16 | 5.5 Medium |
| Out-of-bounds read in Windows Wireless Wide Area Network Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69860 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-16 | 8.8 High |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69859 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-16 | 7 High |
| Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69858 | 1 Microsoft | 3 Windows Server 2022, Windows Server 2025, Windows Server 2025 (server Core Installation) | 2026-09-16 | 8.1 High |
| Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-92717 | 1 Cobbr | 1 Covenant | 2026-09-16 | 9.1 Critical |
| Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster. | ||||
| CVE-2026-85197 | 1 Redhat | 1 Enterprise Linux | 2026-09-16 | 7.6 High |
| A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution. | ||||
| CVE-2026-91772 | 2026-09-16 | 6.1 Medium | ||
| Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships. | ||||
| CVE-2026-91750 | 1 Tencent | 1 Weknora | 2026-09-16 | 6.5 Medium |
| WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata. | ||||
| CVE-2026-90945 | 1 Crawlab-team | 1 Crawlab | 2026-09-16 | 9.8 Critical |
| Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes. | ||||
| CVE-2026-90876 | 1 Sourcecodester | 1 Online Faculty Clearance System | 2026-09-16 | 7.3 High |
| A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-90854 | 2 Katojkalemba, Sourcecodester | 2 Online Food Ordering System, Online Food Ordering System | 2026-09-16 | 7.3 High |
| A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-90848 | 1 Governikus | 1 Ausweisapp | 2026-09-16 | 4.3 Medium |
| A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor. | ||||