Export limit exceeded: 408576 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408576 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85939 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 5.3 Medium |
| Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-104005 | 1 Mongodb | 1 Mongodb Server | 2026-10-13 | 6.5 Medium |
| A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance. | ||||
| CVE-2026-79609 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary. | ||||
| CVE-2026-55695 | 1 Fearlessgeekmedia | 1 Fearlesscms | 2026-10-13 | 9.1 Critical |
| FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b. | ||||
| CVE-2026-83646 | 1 Microsoft | 6 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 3 more | 2026-10-13 | 4.8 Medium |
| Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-81964 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more | 2026-10-13 | 5.5 Medium |
| Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-70580 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-13 | 8.8 High |
| Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. | ||||
| CVE-2026-70280 | 1 Microsoft | 7 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 4 more | 2026-10-13 | 4.4 Medium |
| Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-76282 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 8.8 High |
| Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-102865 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 6.5 Medium |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-102863 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 8.8 High |
| Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102860 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 8.8 High |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-76283 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 7.6 High |
| Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-76284 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 9.8 Critical |
| Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-76285 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 9.8 Critical |
| Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-103572 | 1 Microsoft | 2 Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-13 | 8.8 High |
| Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70414 | 1 Dell | 2 Command\|configure, Command|configure | 2026-10-13 | 5.5 Medium |
| Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure. | ||||
| CVE-2026-100762 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 9.6 Critical |
| Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-100763 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 9.1 Critical |
| Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-102404 | 1 Elastic | 1 Elasticsearch | 2026-10-13 | 6.5 Medium |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability. | ||||