Export limit exceeded: 413905 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 14425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 413905 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (413905 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-41050 1 Suse 2 Rancher, Rancher Fleet 2026-10-20 9.9 Critical
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
CVE-2026-100215 1 Microsoft 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more 2026-10-20 7.8 High
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
CVE-2026-100216 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-20 7 High
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-100217 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-20 7.8 High
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
CVE-2026-1961 3 Red Hat, Redhat, Theforeman 7 Red Hat Satellite 6, Enterprise Linux, Satellite and 4 more 2026-10-20 8 High
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
CVE-2026-100218 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-10-20 8.1 High
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
CVE-2026-110882 2 Cozy Vision Technologies Pvt. Ltd., Wordpress-extensions 2 Sms Alert Order Notifications, Sms Alert Order Notifications 2026-10-20 4.3 Medium
Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.
CVE-2026-100219 1 Microsoft 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more 2026-10-20 9.8 Critical
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVE-2026-100220 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-20 8.8 High
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
CVE-2026-100222 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-20 9.8 Critical
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVE-2026-100225 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-20 7 High
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-102186 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-20 4.7 Medium
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
CVE-2026-111090 1 Stormshield 1 Stormshield Network Security 2026-10-20 7.8 High
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
CVE-2026-43855 1 Advantech 1 Adam-3600 2026-10-20 N/A
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
CVE-2026-102187 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-20 5.5 Medium
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-111124 1 Nasa 1 Cfitsio 2026-10-20 6.1 Medium
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
CVE-2026-111217 2 Netgate, Pfsense 2 Pfsense, Pfsense 2026-10-20 7.2 High
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
CVE-2026-111218 2 Netgate, Pfsense 2 Pfsense, Pfsense 2026-10-20 7.2 High
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
CVE-2026-111219 2 Netgate, Pfsense 2 Pfsense, Pfsense 2026-10-20 6.6 Medium
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
CVE-2026-111221 2 Netgate, Pfsense 2 Pfsense, Pfsense 2026-10-20 6.6 Medium
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.