Export limit exceeded: 410136 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410136 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-83888 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 6.5 Medium |
| Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-83714 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83881 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83877 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 7.8 High |
| Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-112008 | 2026-10-18 | 6.1 Medium | ||
| libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application. | ||||
| CVE-2026-70566 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83902 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85842 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-18 | 7.8 High |
| Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85851 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-18 | 7.8 High |
| Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83903 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-111283 | 2026-10-18 | 9 Critical | ||
| BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records. | ||||
| CVE-2026-111677 | 2026-10-18 | 5.5 Medium | ||
| Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process. | ||||
| CVE-2026-112063 | 2026-10-18 | 5.9 Medium | ||
| libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds. | ||||
| CVE-2026-112061 | 2026-10-18 | 4.3 Medium | ||
| librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client. | ||||
| CVE-2026-112060 | 2026-10-18 | 6.4 Medium | ||
| librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes. | ||||
| CVE-2026-112059 | 1 Liblas | 1 Liblas | 2026-10-18 | 6.1 Medium |
| libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes. | ||||
| CVE-2026-112056 | 2026-10-18 | 5.5 Medium | ||
| wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord. | ||||
| CVE-2026-112055 | 2026-10-18 | 5.5 Medium | ||
| wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord. | ||||
| CVE-2026-112054 | 2026-10-18 | 5.5 Medium | ||
| Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service. | ||||
| CVE-2026-112053 | 2026-10-18 | 5.5 Medium | ||
| Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications. | ||||