Export limit exceeded: 396015 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (396015 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-69648 1 Microsoft 15 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 12 more 2026-09-21 7 High
Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.
CVE-2026-69645 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-09-21 7 High
Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
CVE-2026-69628 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-09-21 8.8 High
Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to execute code over a network.
CVE-2026-72944 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-09-21 7.8 High
Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72943 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more 2026-09-21 7.5 High
Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
CVE-2026-72942 1 Microsoft 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more 2026-09-21 6.5 Medium
Out-of-bounds read in Windows Spaceport.sys allows an unauthorized attacker to disclose information over a network.
CVE-2026-72964 1 Microsoft 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more 2026-09-21 5.5 Medium
Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.
CVE-2026-72962 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-09-21 8.2 High
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-72953 1 Microsoft 15 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 12 more 2026-09-21 7.8 High
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-76781 1 Redhat 6 Enterprise Linux, Hardened Images, Hummingbird and 3 more 2026-09-21 5.5 Medium
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
CVE-2026-72948 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more 2026-09-21 6.7 Medium
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
CVE-2026-72954 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more 2026-09-21 7.5 High
Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
CVE-2026-72947 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-09-21 6.4 Medium
Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.
CVE-2026-88742 2026-09-21 5.4 Medium
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.
CVE-2026-39040 2026-09-21 5.4 Medium
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
CVE-2026-92037 1 Mozilla 1 Firefox 2026-09-21 9.8 Critical
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
CVE-2026-83265 1 Oracle 1 Web Services Manager 2026-09-21 8.2 High
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVE-2026-82163 1 Dell 1 Command | Intel Vpro Out Of Band 2026-09-21 5.5 Medium
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
CVE-2026-49810 2026-09-21 7.8 High
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
CVE-2026-69190 1 Graylog2 1 Graylog2-server 2026-09-21 6.3 Medium
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.