Export limit exceeded: 410843 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410843 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113390 | 1 Draytek | 1 Vigor2960 Firmware | 2026-10-20 | 9.9 Critical |
| A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108433 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 7.8 High |
| Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-98452 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 6.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE. Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures. | ||||
| CVE-2026-98456 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 4.1 Medium |
| In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation count can then become eligible for the fill pass, causing an out-of-bounds write to rp->index[]. Allocate space for every device on hci_dev_list. Since list membership cannot change while hci_dev_list_lock is held, the response remains large enough regardless of flag transitions. The reported count and response length still include only eligible unconfigured controllers. | ||||
| CVE-2026-98458 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 3.3 Low |
| In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold returned for the current call is unused in both cases. This occurs when deferred setup calls iso_connect_cis() again for its existing socket, or when another socket attempts to reuse the CIS. Detect the idempotent case while the connection is locked and release the unused hold after iso_chan_add(). Also release it on -EBUSY. Do not drop it for other errors: a newly allocated iso_conn releases the transferred hold when its last temporary reference is put. | ||||
| CVE-2026-98466 | 1 Linux | 1 Linux Kernel | 2026-10-20 | 8.2 High |
| In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Walk each stack's VA range with the same walker. | ||||
| CVE-2026-109831 | 2026-10-20 | N/A | ||
| UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition. | ||||
| CVE-2026-113386 | 1 Roundcube | 1 Webmail | 2026-10-20 | 7.1 High |
| Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands. | ||||
| CVE-2026-100737 | 2026-10-20 | N/A | ||
| Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware. | ||||
| CVE-2026-97627 | 2026-10-20 | N/A | ||
| Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands. | ||||
| CVE-2026-97812 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-20 | 7 High |
| Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108434 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108435 | 1 Microsoft | 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more | 2026-10-20 | 6.5 Medium |
| Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108436 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108437 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-20 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108438 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 6.5 Medium |
| Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108439 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108440 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108441 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108442 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-10-20 | 8.8 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||