Export limit exceeded: 15302 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 52828 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (52828 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108901 | 1 Shenzhen Hcc Technology | 1 Mpos M6 Plus | 2026-10-13 | 3.5 Low |
| A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108893 | 1 Linksys | 2 E1700, E1700 Firmware | 2026-10-13 | 9.9 Critical |
| A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-104344 | 2026-10-13 | 7.8 High | ||
| Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-102227 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7.8 High |
| Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | ||||
| CVE-2026-110111 | 1 Xen-orchestra | 1 Xen Orchestra Server | 2026-10-13 | 7.5 High |
| Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution. | ||||
| CVE-2026-97801 | 1 Microsoft | 2 .net, .net Framework | 2026-10-13 | 7.5 High |
| Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-97817 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 6.5 Medium |
| Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97815 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97814 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97813 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-13 | 6.5 Medium |
| Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97805 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96113 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-13 | 9.8 Critical |
| Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69982 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 R2 and 4 more | 2026-10-13 | 5.9 Medium |
| Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-85939 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 5.3 Medium |
| Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-100763 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 9.1 Critical |
| Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-102408 | 1 Elastic | 1 Elasticsearch | 2026-10-13 | 4.3 Medium |
| Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue. | ||||
| CVE-2026-100764 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 8.8 High |
| Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-109731 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-82162 | 1 Dell | 2 Command\|configure, Command|configure | 2026-10-13 | 7.4 High |
| Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2026-41504 | 1 Coraza | 1 Coraza | 2026-10-13 | 5.8 Medium |
| OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0. | ||||