Export limit exceeded: 409300 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409300 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409300 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409300 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110014 | 2026-10-16 | 5.3 Medium | ||
| The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment. | ||||
| CVE-2026-110039 | 2026-10-16 | 2.7 Low | ||
| The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network. | ||||
| CVE-2026-110135 | 2026-10-16 | 7.4 High | ||
| The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password. | ||||
| CVE-2026-81964 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-16 | 5.5 Medium |
| Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-97003 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85816 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-10-16 | 5.7 Medium |
| Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information over an adjacent network. | ||||
| CVE-2026-85817 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 8.8 High |
| Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-61624 | 2 Fortinet, Siemens | 6 Fortios, Fortipam, Fortiproxy and 3 more | 2026-10-16 | 5.4 Medium |
| An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. | ||||
| CVE-2026-102764 | 1 Beyondtrust | 1 Remote Support | 2026-10-16 | 9.8 Critical |
| The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. | ||||
| CVE-2026-85818 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-16 | 9 Critical |
| Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-85820 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-110452 | 1 Nixos | 1 Nix | 2026-10-16 | 4 Medium |
| The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership. | ||||
| CVE-2026-110453 | 1 Nixos | 1 Nix | 2026-10-16 | 4.3 Medium |
| Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. | ||||
| CVE-2026-85821 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 6.5 Medium |
| Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-46471 | 2026-10-16 | 4.3 Medium | ||
| An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents. | ||||
| CVE-2026-89057 | 1 Lenovo | 31 Idea Tab Lenovo Tab K11 Gen 2 Tb336fu , Idea Tab Lenovo Tab K11 Gen 2 Tb336fu Tb336zu , Idea Tab Lenovo Tab K11 Gen 2 Tb336zu and 28 more | 2026-10-16 | 6.8 Medium |
| A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access. | ||||
| CVE-2026-85822 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85823 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-16 | 7 High |
| Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85824 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-16 | 7 High |
| Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85825 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7 High |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||