Export limit exceeded: 109500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-46773 | 1 Fortinet | 3 Fortianalyzer, Fortianalyzer Cloud, Fortianalyzercloud | 2026-10-16 | 7.9 High |
| An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests. | ||||
| CVE-2026-97770 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-16 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97768 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97745 | 1 Microsoft | 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more | 2026-10-16 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-106560 | 2 Backstage, Linuxfoundation | 4 Backstage, Plugin-scaffolder-backend-module-confluence-to-markdown, Backstage and 1 more | 2026-10-16 | 7.1 High |
| Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. This issue is fixed in version 0.3.25. | ||||
| CVE-2026-96215 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-16 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-111311 | 2026-10-16 | 8.8 High | ||
| The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active. | ||||
| CVE-2026-107564 | 1 Gocsaf | 1 Csaf Provider | 2026-10-16 | 7.5 High |
| An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service. | ||||
| CVE-2026-108131 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-16 | 7.5 High |
| No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-11732 | 1 Netgear | 4 Cax30, Rax30, Rax5 and 1 more | 2026-10-16 | 8.8 High |
| An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on. | ||||
| CVE-2026-11731 | 1 Netgear | 3 Rax28, Rax29, Rax30 | 2026-10-16 | 8.8 High |
| An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions. | ||||
| CVE-2026-13043 | 2 Microsoft, Watchguard | 2 Windows, Endpoint Security | 2026-10-16 | 8.8 High |
| A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory. | ||||
| CVE-2026-96044 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 8.8 High |
| No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62840 | 1 Microsoft | 1 Linux 3p \(third Party\) Distros | 2026-10-16 | 7 High |
| Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70213 | 1 Microsoft | 2 Power-apps, Power Apps For Android | 2026-10-16 | 8 High |
| Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-105592 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105591 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102863 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 8.8 High |
| Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102860 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 8.8 High |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102858 | 1 Microsoft | 6 Microsoft 365, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. | ||||