Export limit exceeded: 412386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412386 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412386 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96222 | 3 Apple, Linux, Microsoft | 24 Macos, Linux Kernel, .net and 21 more | 2026-10-20 | 7.4 High |
| Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-96246 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 7.5 High |
| Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-96251 | 1 Microsoft | 1 Powershell | 2026-10-20 | 8.8 High |
| Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96252 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-20 | 9.1 Critical |
| Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-96300 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 5.9 Medium |
| Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96303 | 1 Microsoft | 1 Powershell | 2026-10-20 | 6.5 Medium |
| Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-96853 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 4.7 Medium |
| Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96855 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-10-20 | 5.5 Medium |
| Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-96856 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 7.8 High |
| Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-104915 | 2 Kodezen, Wordpress-extensions | 2 Academy Lms, Academy Lms | 2026-10-20 | 6.5 Medium |
| The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses. | ||||
| CVE-2026-110672 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-20 | N/A |
| Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory. | ||||
| CVE-2026-112768 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-20 | N/A |
| Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout. | ||||
| CVE-2026-112770 | 1 Craftcms | 2 Cms, Craft Cms | 2026-10-20 | 8.8 High |
| Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user. | ||||
| CVE-2026-96857 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-20 | 5.5 Medium |
| Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-101307 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 9.1 Critical |
| When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic. | ||||
| CVE-2026-101306 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 9.8 Critical |
| SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | ||||
| CVE-2026-101305 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 8.8 High |
| renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | ||||
| CVE-2026-19754 | 1 Baserow | 1 Baserow | 2026-10-20 | N/A |
| Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions. | ||||
| CVE-2026-101303 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 7.5 High |
| The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation. | ||||
| CVE-2026-101302 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 6.5 Medium |
| TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS). | ||||