Export limit exceeded: 413097 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10444 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-97017 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-10-16 8.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97010 1 Microsoft 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more 2026-10-16 8.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-108136 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-16 7.8 High
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-85811 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.5 High
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-96852 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7 High
Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-70023 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-10-16 7.8 High
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-72222 1 Linux 1 Linux Kernel 2026-10-16 9.8 Critical
In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback svc_tcp_handshake() stores the raw svc_xprt pointer in tls_handshake_args.ta_data and submits the request through tls_server_hello_x509(). The handshake core takes only sock_hold(req->hr_sk); nothing references the embedding struct svc_sock that svc_tcp_handshake_done() reaches via container_of(). Two close races leave the in-flight callback writing through a freed svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards its return value: a false return means handshake_complete() has already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have finished, yet svc_sock_free() proceeds to kfree(svsk). The cancel-loser fall-through inside svc_tcp_handshake() itself produces the same window: when wait_for_completion_interruptible_timeout() returns <= 0 (timeout or signal) and tls_handshake_cancel() returns false, the function does not drain, returns, and svc_handle_xprt() calls svc_xprt_received(), which clears XPT_BUSY and can drop the last reference. A concurrent close then runs svc_sock_free() while svc_tcp_handshake_done() is still updating xpt_flags and walking svsk->sk_handshake_done. The corruption surfaces as set_bit/clear_bit RMW into the freed xpt_flags slab slot and as complete_all() walking and writing the freed wait_queue_head_t list embedded in sk_handshake_done -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVC_HANDSHAKE_TO expiry. Take svc_xprt_get(xprt) immediately before tls_server_hello_x509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tls_server_hello_x509() and a successful tls_handshake_cancel() -- and at the tail of svc_tcp_handshake_done() after complete_all(). [cel: rewrote commit message to describe the actual change]
CVE-2026-83749 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-16 7 High
Use after free in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-70038 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 8.1 High
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
CVE-2026-70025 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 5.3 Medium
Use after free in Windows Netlogon allows an authorized attacker to deny service over a network.
CVE-2026-70014 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.5 High
Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.
CVE-2026-85372 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7 High
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-72969 1 Microsoft 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more 2026-10-16 7 High
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97743 1 Microsoft 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more 2026-10-16 6.5 Medium
Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-85790 1 Microsoft 18 .net, Microsoft.native.quic.msquic.schannel, Microsoft Visual Studio 2026 Version 18.10 and 15 more 2026-10-16 5.9 Medium
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-83726 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-16 7.8 High
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-69935 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-10-16 7 High
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69931 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-10-16 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-70136 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-10-16 7 High
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-105010 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-10-16 9.8 Critical
Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.