Export limit exceeded: 412512 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412512 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110247 | 1 Mozilla | 1 Thunderbird | 2026-10-20 | 8.4 High |
| Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158. | ||||
| CVE-2026-106173 | 1 Fortinet | 1 Fortisiem | 2026-10-20 | 9.4 Critical |
| A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets. | ||||
| CVE-2026-102196 | 1 Microsoft | 17 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 14 more | 2026-10-20 | 7.8 High |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-110249 | 1 Mozilla | 1 Thunderbird | 2026-10-20 | 8.6 High |
| A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5. | ||||
| CVE-2026-91057 | 2026-10-20 | N/A | ||
| `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source. | ||||
| CVE-2026-98154 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 7 High |
| In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path. | ||||
| CVE-2026-96995 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-10-20 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-112937 | 1 Tox-dev | 1 Filelock | 2026-10-20 | 6.1 Medium |
| filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-113359 | 1 Baserow | 1 Baserow | 2026-10-20 | 4.3 Medium |
| Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to. | ||||
| CVE-2026-101292 | 1 Redhat | 4 Amq Broker, Amq Broker 7, Jboss Enterprise Application Platform and 1 more | 2026-10-20 | 8.2 High |
| Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation. | ||||
| CVE-2026-102197 | 1 Microsoft | 17 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 14 more | 2026-10-20 | 7 High |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102198 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 5.3 Medium |
| Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-86922 | 1 Apple | 4 Ios And Ipados, Macos, Safari and 1 more | 2026-10-20 | 8.8 High |
| A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-86928 | 1 Apple | 1 Macos | 2026-10-20 | 5.5 Medium |
| A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data. | ||||
| CVE-2026-97278 | 2 Wordpress-extensions, Wp Syntex | 2 Polylang, Polylang | 2026-10-20 | 7.2 High |
| Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9. | ||||
| CVE-2026-113465 | 1 Stormshield | 1 Stormshield Network Security | 2026-10-20 | 6.6 Medium |
| It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link. | ||||
| CVE-2026-102199 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 6.5 Medium |
| Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-86976 | 1 Apple | 2 Ios And Ipados, Macos | 2026-10-20 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-101201 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-10-20 | 5.5 Medium |
| A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read. | ||||
| CVE-2026-110976 | 1 Wordpress-extensions | 1 Ai Engine | 2026-10-20 | 4.9 Medium |
| The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles. | ||||