Export limit exceeded: 409219 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409219 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102022 | 2026-10-16 | 7.5 High | ||
| A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP-LS peer to cause an rpd crash via a crafted BGP-LS Link NLRI advertisements. | ||||
| CVE-2026-102020 | 2026-10-16 | 7.5 High | ||
| A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via BGP-LS routing updates. | ||||
| CVE-2026-24723 | 1 Qnap | 1 File Station | 2026-10-16 | 6.5 Medium |
| A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | ||||
| CVE-2026-109587 | 1 Freertos | 1 Freertos-kernel | 2026-10-16 | 8.8 High |
| Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later. | ||||
| CVE-2026-97766 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-66272 | 1 Qnap | 1 Video Station | 2026-10-16 | 6.5 Medium |
| A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later | ||||
| CVE-2025-66275 | 1 Qnap | 1 Video Station | 2026-10-16 | 6.5 Medium |
| A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later | ||||
| CVE-2026-26244 | 1 Qnap | 1 Video Station | 2026-10-16 | 8.8 High |
| A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | ||||
| CVE-2026-26245 | 1 Qnap | 1 Video Station | 2026-10-16 | 8.8 High |
| A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | ||||
| CVE-2026-34015 | 1 Qnap | 1 Video Station | 2026-10-16 | 6.5 Medium |
| A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | ||||
| CVE-2026-80092 | 1 Microsoft | 1 Microsoft-identity-web | 2026-10-16 | 5.3 Medium |
| Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-109461 | 1 Microsoft | 1 Microsoft Identity Client For Nodejs | 2026-10-16 | 5.9 Medium |
| Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-44084 | 1 Qnap | 1 Video Station | 2026-10-16 | 7.5 High |
| An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | ||||
| CVE-2026-96244 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-10-16 | 7.8 High |
| Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96220 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-10-16 | 7.8 High |
| Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-87714 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 6.5 Medium |
| Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-96223 | 1 Microsoft | 9 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 6 more | 2026-10-16 | 7.8 High |
| Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96243 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-10-16 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-59962 | 2026-10-16 | 6.5 Medium | ||
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10. | ||||
| CVE-2026-59967 | 2026-10-16 | 5.4 Medium | ||
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10. | ||||