Export limit exceeded: 410516 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410516 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410516 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410516 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96853 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 4.7 Medium |
| Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96854 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-20 | 5.5 Medium |
| Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96855 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-10-20 | 5.5 Medium |
| Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-96856 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 7.8 High |
| Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71170 | 2026-10-20 | 7.8 High | ||
| Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution. | ||||
| CVE-2026-82166 | 2026-10-20 | 8.8 High | ||
| Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution. | ||||
| CVE-2026-71169 | 2026-10-20 | 7 High | ||
| Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information | ||||
| CVE-2026-104915 | 2 Kodezen, Wordpress-extensions | 2 Academy Lms, Academy Lms | 2026-10-20 | 6.5 Medium |
| The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses. | ||||
| CVE-2026-110672 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-20 | N/A |
| Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory. | ||||
| CVE-2026-112768 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-20 | N/A |
| Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout. | ||||
| CVE-2026-112770 | 1 Craftcms | 2 Cms, Craft Cms | 2026-10-20 | 8.8 High |
| Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user. | ||||
| CVE-2026-112771 | 1 Craftcms | 2 Cms, Craft Cms | 2026-10-20 | 6.5 Medium |
| Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens. | ||||
| CVE-2026-96857 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-20 | 5.5 Medium |
| Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-101307 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 9.1 Critical |
| When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic. | ||||
| CVE-2026-101306 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 9.8 Critical |
| SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | ||||
| CVE-2026-101305 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 8.8 High |
| renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | ||||
| CVE-2026-101304 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 7.1 High |
| When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction. | ||||
| CVE-2026-19754 | 1 Baserow | 1 Baserow | 2026-10-20 | N/A |
| Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions. | ||||
| CVE-2026-112373 | 1 H3c | 2 Magic Nx15, Magic Nx15 Firmware | 2026-10-20 | 6.5 Medium |
| A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-101303 | 1 Freebsd | 1 Freebsd | 2026-10-20 | 7.5 High |
| The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation. | ||||