Export limit exceeded: 106925 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (106925 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-88114 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-23 8.8 High
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88116 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-23 8.8 High
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-108396 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-23 7 High
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-111633 2026-10-23 8.6 High
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
CVE-2026-111613 1 Alldata 1 Alldata 2026-10-23 7.5 High
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
CVE-2026-83931 1 Microsoft 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more 2026-10-23 7.8 High
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVE-2026-83930 1 Microsoft 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more 2026-10-23 7 High
Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85941 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-23 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-87694 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-23 7.8 High
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-88072 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-23 7.8 High
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
CVE-2026-88139 1 Microsoft 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more 2026-10-23 7 High
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-88194 1 Microsoft 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more 2026-10-23 7.8 High
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-88193 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-23 7.8 High
Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally.
CVE-2026-70112 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-10-23 7.8 High
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to execute code locally.
CVE-2026-70158 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-23 8.8 High
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVE-2026-95713 2026-10-23 7 High
An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.
CVE-2026-95710 1 Hpe 1 Aos 2026-10-23 7.1 High
An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected system, with a limited impact to the integrity of the affected component.
CVE-2026-95708 2026-10-23 7.2 High
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVE-2026-79956 2026-10-23 7.2 High
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.
CVE-2026-79894 1 Hpe 1 Aos 2026-10-23 7.5 High
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.