Export limit exceeded: 410490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410490 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112005 | 1 Clidey | 1 Whodb | 2026-10-18 | 7.7 High |
| WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files. | ||||
| CVE-2026-112003 | 1 Projectsend | 1 Projectsend | 2026-10-18 | 5.9 Medium |
| ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files. | ||||
| CVE-2026-70173 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83669 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 7.8 High |
| Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83755 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83857 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83860 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.5 High |
| Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-74033 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-18 | 6.1 Medium |
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db. | ||||
| CVE-2026-83578 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 9.8 Critical |
| Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-83683 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 6.5 Medium |
| Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-84471 | 1 Openvpn | 1 Openvpn | 2026-10-18 | N/A |
| The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry. | ||||
| CVE-2026-70140 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 7 High |
| Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83876 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83702 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7 High |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83870 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-18 | 5.5 Medium |
| Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83707 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 7 High |
| Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83708 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7 High |
| Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83715 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.1 High |
| Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-83919 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally. | ||||
| CVE-2026-83710 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 7 High |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | ||||