Export limit exceeded: 108624 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (108624 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96765 2 Wordpress-extensions, Wpo365 2 Wpo365, Wpo365 | Seamless Wordpress + Microsoft Integration (wpo365 | Login) 2026-10-25 7.2 High
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.
CVE-2026-70301 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office 365 For Mac and 9 more 2026-10-25 8.8 High
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-88202 1 Microsoft 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more 2026-10-25 8.8 High
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-70015 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-25 7.8 High
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVE-2026-83886 1 Microsoft 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more 2026-10-25 7 High
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-94663 2 Metagauss, Wordpress-extensions 2 Profilegrid, Profilegrid 2026-10-25 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.
CVE-2026-84020 1 Microsoft 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more 2026-10-25 7 High
Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
CVE-2026-85837 1 Microsoft 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more 2026-10-25 7.8 High
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-83871 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-25 7 High
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVE-2026-84016 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7.8 High
Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally.
CVE-2026-94256 1 Wordpress-extensions 1 Sms Alert 2026-10-25 8.1 High
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.
CVE-2026-85370 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7 High
Use after free in WebDAV allows an authorized attacker to elevate privileges locally.
CVE-2026-85798 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7.2 High
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
CVE-2026-85811 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7.5 High
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-85915 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-25 7.8 High
Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-102857 1 Microsoft 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more 2026-10-25 8.8 High
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
CVE-2026-69909 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7.8 High
Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally.
CVE-2026-69945 1 Microsoft 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more 2026-10-25 8.8 High
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
CVE-2026-69957 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7.8 High
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-85802 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-25 7 High
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.