Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409415 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-50218 | 2026-10-16 | 8.5 High | ||
| Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment. | ||||
| CVE-2026-110447 | 2026-10-16 | N/A | ||
| Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. | ||||
| CVE-2026-110449 | 1 Nixos | 1 Nix | 2026-10-16 | 7.5 High |
| Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. | ||||
| CVE-2026-107153 | 2026-10-16 | N/A | ||
| Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed. | ||||
| CVE-2026-111385 | 2026-10-16 | 4.8 Medium | ||
| Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files. | ||||
| CVE-2026-110450 | 1 Nixos | 1 Nix | 2026-10-16 | 8 High |
| Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification. | ||||
| CVE-2026-106931 | 2026-10-16 | N/A | ||
| SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. | ||||
| CVE-2026-108427 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108431 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108433 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 7.8 High |
| Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-108434 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108436 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108437 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108438 | 1 Microsoft | 4 365 Apps, Office 365, Office Macos 2021 and 1 more | 2026-10-16 | 6.5 Medium |
| Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-108439 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108440 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108441 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108442 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108444 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108445 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-16 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||