Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 409415 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 43), (line:1, col:44)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (409415 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96620 2026-10-16 N/A
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.
CVE-2026-85805 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 6.5 Medium
Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-85806 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 9.8 Critical
Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
CVE-2026-85807 1 Microsoft 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more 2026-10-16 7.8 High
Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-85808 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.5 High
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
CVE-2026-85811 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.5 High
Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-96927 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 5.5 Medium
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-85812 1 Microsoft 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more 2026-10-16 5.5 Medium
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
CVE-2026-96928 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.8 High
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-85814 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 9.8 Critical
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVE-2026-85815 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 5.5 Medium
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
CVE-2026-96943 1 Microsoft 10 Raw Image Extension, Windows 10 1507, Windows 10 1607 and 7 more 2026-10-16 8.8 High
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-96957 3 Apple, Linux, Microsoft 7 Macos, Linux Kernel, .net and 4 more 2026-10-16 8.8 High
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96958 3 Apple, Linux, Microsoft 20 Macos, Linux Kernel, .net and 17 more 2026-10-16 7.5 High
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96959 3 Apple, Linux, Microsoft 20 Macos, Linux Kernel, .net and 17 more 2026-10-16 7.5 High
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96960 3 Apple, Linux, Microsoft 20 Macos, Linux Kernel, .net and 17 more 2026-10-16 7.5 High
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-97788 1 Microsoft 24 .net, .net Framework, Windows 10 1607 and 21 more 2026-10-16 7.5 High
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
CVE-2026-96321 1 Microsoft 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more 2026-10-16 5.5 Medium
Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally.
CVE-2026-111702 2026-10-16 7.5 High
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.
CVE-2026-89098 1 Redhat 2 Enterprise Linux, Openshift 2026-10-16 5.5 Medium
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.