Export limit exceeded: 237699 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (237699 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69565 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7 High |
| Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally. | ||||
| CVE-2026-81384 | 1 Microsoft | 3 Windows Server 2022, Windows Server 2025, Windows Server 2025 (server Core Installation) | 2026-11-14 | 8.1 High |
| Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70120 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88216 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-88218 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 9.8 Critical |
| Double free in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-88220 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-88227 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88228 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88235 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-14 | 7.8 High |
| Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88236 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-11-14 | 7.5 High |
| Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-88823 | 1 Openssl | 1 Openssl | 2026-11-14 | N/A |
| Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary. | ||||
| CVE-2026-88249 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 8.8 High |
| Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-94515 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-94522 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-94527 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95874 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Xbox allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96965 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.3 Medium |
| Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | ||||
| CVE-2026-97015 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 6.8 Medium |
| Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||||
| CVE-2026-95966 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95987 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally. | ||||