Export limit exceeded: 417100 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 107563 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107563 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97745 | 1 Microsoft | 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more | 2026-10-16 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-106560 | 2 Backstage, Linuxfoundation | 4 Backstage, Plugin-scaffolder-backend-module-confluence-to-markdown, Backstage and 1 more | 2026-10-16 | 7.1 High |
| Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. This issue is fixed in version 0.3.25. | ||||
| CVE-2026-96215 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-16 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-111311 | 2026-10-16 | 8.8 High | ||
| The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active. | ||||
| CVE-2026-107564 | 1 Gocsaf | 1 Csaf Provider | 2026-10-16 | 7.5 High |
| An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service. | ||||
| CVE-2026-108131 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-16 | 7.5 High |
| No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-110084 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-16 | 7.1 High |
| Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-11732 | 1 Netgear | 4 Cax30, Rax30, Rax5 and 1 more | 2026-10-16 | 8.8 High |
| An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on. | ||||
| CVE-2026-11731 | 1 Netgear | 3 Rax28, Rax29, Rax30 | 2026-10-16 | 8.8 High |
| An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions. | ||||
| CVE-2026-102560 | 3 Gnome, Libsoup, Redhat | 3 Libsoup, Libsoup, Enterprise Linux | 2026-10-16 | 8.6 High |
| A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. | ||||
| CVE-2026-13043 | 2 Microsoft, Watchguard | 2 Windows, Endpoint Security | 2026-10-16 | 8.8 High |
| A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory. | ||||
| CVE-2026-96044 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 8.8 High |
| No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62840 | 1 Microsoft | 1 Linux 3p \(third Party\) Distros | 2026-10-16 | 7 High |
| Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70213 | 1 Microsoft | 2 Power-apps, Power Apps For Android | 2026-10-16 | 8 High |
| Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-105592 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105591 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102863 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 8.8 High |
| Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102860 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 8.8 High |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102858 | 1 Microsoft | 6 Microsoft 365, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102234 | 1 Microsoft | 1 Visual Studio Code | 2026-10-16 | 7.4 High |
| Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||||