Export limit exceeded: 21833 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237698 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237698 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (237698 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105582 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-11-14 | 7 High |
| Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108409 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-129447 | 1 Yuzutech | 1 Kroki | 2026-11-14 | 6.1 Medium |
| Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin. | ||||
| CVE-2026-129137 | 1 Devolutions | 1 Powershell Universal | 2026-11-14 | N/A |
| Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server. | ||||
| CVE-2026-84005 | 1 Microsoft | 16 Windows 10 1809, Windows 11 23h2, Windows 11 23h2 and 13 more | 2026-11-14 | 5.5 Medium |
| Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-84004 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 5.5 Medium |
| Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83684 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-96176 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-11-14 | 7.5 High |
| Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-112762 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 8.8 High |
| Relative path traversal in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-112797 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-123395 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-14 | 5.9 Medium |
| Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-54831 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-11-14 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Blind SQL Injection.This issue affects GeoDirectory: from n/a through 2.8.162. | ||||
| CVE-2026-128986 | 1 Eclipse | 1 Eclipse Basyx Go Components | 2026-11-14 | N/A |
| In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource. An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`. The issue is fixed in Eclipse BaSyx Go Components v1.1.4. | ||||
| CVE-2026-109491 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-14 | 7.5 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69565 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7 High |
| Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally. | ||||
| CVE-2026-81384 | 1 Microsoft | 3 Windows Server 2022, Windows Server 2025, Windows Server 2025 (server Core Installation) | 2026-11-14 | 8.1 High |
| Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70120 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88216 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-88218 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 9.8 Critical |
| Double free in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-88220 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally. | ||||