Export limit exceeded: 414878 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414878 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65216 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65214 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65221 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65212 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-116368 | 1 Deepseek | 1 Harness | 2026-10-26 | 7.3 High |
| A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-65202 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65222 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65217 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65215 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65203 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-96867 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 7.8 High |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. | ||||
| CVE-2026-116367 | 1 Deepseek | 1 Harness | 2026-10-26 | 6.3 Medium |
| A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-111590 | 2026-10-26 | N/A | ||
| A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address. When a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target. If the target answers with an error status, the response body is written to the webhook execution log, which project members can read, potentially exposing cloud metadata or other network-restricted resources. | ||||
| CVE-2026-105010 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-26 | 9.8 Critical |
| Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-96868 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-26 | 7 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105009 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-26 | 7.5 High |
| Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-15556 | 1 Redhat | 4 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els, Jboss Enterprise Application Platform Expansion Pack and 1 more | 2026-10-26 | 8.1 High |
| A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application. | ||||
| CVE-2026-10579 | 1 Redhat | 2 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els | 2026-10-26 | 9.8 Critical |
| A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws. | ||||
| CVE-2026-96910 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 5.5 Medium |
| Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-105895 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-26 | 9.9 Critical |
| Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | ||||