Export limit exceeded: 414481 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414481 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414481 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78846 | 2026-10-26 | N/A | ||
| Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing. | ||||
| CVE-2026-65218 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65216 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65214 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65221 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65212 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-116368 | 1 Deepseek | 1 Harness | 2026-10-26 | 7.3 High |
| A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-65202 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65222 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65217 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65215 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65203 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-96867 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 7.8 High |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. | ||||
| CVE-2026-112346 | 2026-10-26 | 9.8 Critical | ||
| OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store. | ||||
| CVE-2026-116367 | 1 Deepseek | 1 Harness | 2026-10-26 | 6.3 Medium |
| A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-107092 | 2026-10-26 | 9.8 Critical | ||
| NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. | ||||
| CVE-2026-111590 | 2026-10-26 | N/A | ||
| A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources. | ||||
| CVE-2026-105010 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-26 | 9.8 Critical |
| Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-96868 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-26 | 7 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105009 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-26 | 7.5 High |
| Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | ||||