Export limit exceeded: 409261 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409261 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96928 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102608 | 2026-10-16 | 9 Critical | ||
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3. | ||||
| CVE-2026-96929 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-16 | 7.8 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85814 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85815 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96943 | 1 Microsoft | 10 Raw Image Extension, Windows 10 1507, Windows 10 1607 and 7 more | 2026-10-16 | 8.8 High |
| Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96957 | 3 Apple, Linux, Microsoft | 7 Macos, Linux Kernel, .net and 4 more | 2026-10-16 | 8.8 High |
| Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-96958 | 3 Apple, Linux, Microsoft | 20 Macos, Linux Kernel, .net and 17 more | 2026-10-16 | 7.5 High |
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96959 | 3 Apple, Linux, Microsoft | 20 Macos, Linux Kernel, .net and 17 more | 2026-10-16 | 7.5 High |
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96960 | 3 Apple, Linux, Microsoft | 20 Macos, Linux Kernel, .net and 17 more | 2026-10-16 | 7.5 High |
| Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-97788 | 1 Microsoft | 24 .net, .net Framework, Windows 10 1607 and 21 more | 2026-10-16 | 7.5 High |
| Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-96321 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96843 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102607 | 2026-10-16 | 8.8 High | ||
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3. | ||||
| CVE-2026-96844 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 8 High |
| Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-96846 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96847 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96848 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 7 more | 2026-10-16 | 5.5 Medium |
| Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96849 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-10-16 | 5.5 Medium |
| Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96850 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-10-16 | 5.5 Medium |
| Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. | ||||