Export limit exceeded: 413204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 413204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 106587 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (106587 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-105862 1 Payloadcms 1 Payload 2026-10-15 8.7 High
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
CVE-2026-105865 1 Payloadcms 1 Payload 2026-10-15 8.1 High
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
CVE-2026-105866 1 Payloadcms 1 Payload 2026-10-15 7.5 High
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
CVE-2026-106100 1 Payloadcms 1 Payload 2026-10-15 7.1 High
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.
CVE-2026-84198 1 Ibm 1 Guardium Data Protection 2026-10-15 8.1 High
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-16169 1 Ibm 2 Datapower Gateway, Datapower Gateway 1100 2026-10-15 7.5 High
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-16170 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
CVE-2026-16176 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
CVE-2026-16178 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.
CVE-2026-16179 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
CVE-2026-16181 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.4 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
CVE-2026-15781 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 8 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-15784 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 8.1 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-15819 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.
CVE-2026-15822 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
CVE-2026-15824 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 8.2 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
CVE-2026-16111 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
CVE-2026-16159 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 8.6 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
CVE-2026-16161 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 7.5 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
CVE-2026-16163 1 Ibm 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more 2026-10-15 8.6 High
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.