Export limit exceeded: 416946 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416946 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416946 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416946 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115402 | 1 Openvpn | 1 Ovpn-dco-win | 2026-10-28 | N/A |
| OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path. | ||||
| CVE-2026-99129 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-28 | 6.3 Medium |
| In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinux_bpf_token_create()) or the token itself (in selinux_bpf_map_create() and selinux_bpf_prog_load()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel. | ||||
| CVE-2026-115968 | 2 Ultimatemember, Wordpress-extensions | 2 Ultimate Member, Ultimate Member | 2026-10-28 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1. | ||||
| CVE-2026-44179 | 1 Xwikisas | 1 Xwiki-pro-macros | 2026-10-28 | 9.9 Critical |
| XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5. | ||||
| CVE-2026-83526 | 2026-10-28 | 8.8 High | ||
| The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player creation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This requires successfully exploiting a race condition, and is only exploitable if the '[fvplayer_editor]' shortcode is present, or the "Enable profile videos" setting is enabled. | ||||
| CVE-2026-96864 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-28 | 9.8 Critical |
| Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96866 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-28 | 7.5 High |
| Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96865 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-28 | 5.6 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96863 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-28 | 6.8 Medium |
| Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-96862 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-28 | 7.8 High |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96861 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-28 | 7.5 High |
| Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-88141 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-28 | 7 High |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88139 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-28 | 7 High |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69988 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-28 | 7.5 High |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-88127 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-28 | 7 High |
| Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88120 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-28 | 8.1 High |
| Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85905 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-28 | 8.8 High |
| Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85906 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-28 | 7.8 High |
| Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85908 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-28 | 7.8 High |
| Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85927 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-28 | 7.8 High |
| Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | ||||