Export limit exceeded: 33179 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (33179 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-88128 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-28 7.8 High
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-88140 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-28 5.5 Medium
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
CVE-2026-88142 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 8.8 High
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
CVE-2026-83637 1 Microsoft 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more 2026-10-28 7.8 High
Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-88143 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-28 6.7 Medium
Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVE-2026-88147 1 Microsoft 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more 2026-10-28 7.8 High
Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
CVE-2026-88157 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-28 8.8 High
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CVE-2026-83585 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 7.8 High
Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-88159 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 8.8 High
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
CVE-2026-83579 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 7.8 High
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVE-2026-96859 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 5.5 Medium
Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.
CVE-2026-96860 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 5.5 Medium
Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
CVE-2026-83573 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 6.8 Medium
Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-83567 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-28 7.8 High
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-83565 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-28 5.5 Medium
Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
CVE-2026-96644 3 Microsoft, Python, Python-pillow 3 Windows, Pillow, Pillow 2026-10-28 8.1 High
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.
CVE-2026-114509 1 Laravel 1 Framework 2026-10-28 N/A
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
CVE-2023-0698 1 Google 1 Chrome 2026-10-28 8.8 High
Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2026-98111 1 Linux 1 Linux Kernel 2026-10-28 7.1 High
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
CVE-2026-98110 1 Linux 1 Linux Kernel 2026-10-28 7.1 High
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. Limit the conversion to the advertised TLV value length.