Export limit exceeded: 102118 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (102118 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70587 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.5 High |
| Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-71337 | 1 Microsoft | 15 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 12 more | 2026-09-15 | 7.8 High |
| Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71340 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-09-15 | 7 High |
| Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71342 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-15 | 7 High |
| Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71343 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.8 High |
| Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally. | ||||
| CVE-2026-84445 | 1 Grpc | 1 Grpc-go | 2026-09-15 | 7.5 High |
| gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2. | ||||
| CVE-2026-16673 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-15 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property. | ||||
| CVE-2026-70289 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.8 High |
| Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69638 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 8.4 High |
| Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-69669 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 8.8 High |
| Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69709 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.8 High |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. | ||||
| CVE-2026-69846 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-15 | 8.2 High |
| Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69875 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-15 | 8 High |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69906 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-15 | 8.2 High |
| Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-43133 | 1 Linux | 1 Linux Kernel | 2026-09-15 | 7.9 High |
| In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code to always use vmcb01. As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01 instead of the current VMCB. | ||||
| CVE-2026-39829 | 1 Golang | 2 Crypto, Ssh | 2026-09-15 | 7.5 High |
| The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. | ||||
| CVE-2026-33814 | 2 Go Standard Library, Golang | 3 Net/http, Go, Http2 | 2026-09-15 | 7.5 High |
| When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | ||||
| CVE-2026-33811 | 2 Go Standard Library, Golang | 2 Net, Go | 2026-09-15 | 7.5 High |
| When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | ||||
| CVE-2026-27137 | 2 Go Standard Library, Golang | 2 Crypto Tls, Go | 2026-09-15 | 7.5 High |
| When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered. | ||||
| CVE-2026-72693 | 1 Redhat | 5 Enterprise Linux, Hardened Images, Hummingbird and 2 more | 2026-09-15 | 7.8 High |
| `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path. | ||||