Export limit exceeded: 424994 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424994 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105524 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-11 | 7.8 High |
| Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-109473 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-11 | 7.8 High |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108469 | 1 Microsoft | 1 Authentication Library For Javascript | 2026-11-11 | 6.8 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-109495 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 6.6 Medium |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-109504 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 7.3 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-62971 | 2026-11-11 | 7.2 High | ||
| The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0. | ||||
| CVE-2026-123384 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123379 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123378 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 7.5 High |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123377 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123376 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123375 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120791 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120790 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120789 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120788 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120786 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120785 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120005 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119986 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||