Export limit exceeded: 25372 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409052 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409052 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96313 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-10-16 | 7 High |
| Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96323 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-16 | 7 High |
| Use after free in Windows Update allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-49950 | 2026-10-16 | 9.8 Critical | ||
| Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes. | ||||
| CVE-2026-75941 | 1 Lenovo | 1 Legion Zone Application | 2026-10-16 | 8 High |
| A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code. | ||||
| CVE-2026-89057 | 1 Lenovo | 31 Idea Tab Lenovo Tab K11 Gen 2 Tb336fu , Idea Tab Lenovo Tab K11 Gen 2 Tb336fu Tb336zu , Idea Tab Lenovo Tab K11 Gen 2 Tb336zu and 28 more | 2026-10-16 | 6.8 Medium |
| A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access. | ||||
| CVE-2026-92629 | 1 Lenovo | 1 Baiying Pc Client | 2026-10-16 | 7.3 High |
| A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges. | ||||
| CVE-2026-92777 | 1 Lenovo | 27 Idea Tab Lenovo Tab K11 Gen 2 Tb336fu , Idea Tab Lenovo Tab K11 Gen 2 Tb336fu Tb336zu , Idea Tab Lenovo Tab K11 Gen 2 Tb336zu and 24 more | 2026-10-16 | 6.4 Medium |
| A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code. | ||||
| CVE-2026-101021 | 2026-10-16 | 7.5 High | ||
| MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying. | ||||
| CVE-2026-107917 | 1 Netgear | 1 R7300dst | 2026-10-16 | 4.5 Medium |
| Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices. | ||||
| CVE-2026-96322 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7 High |
| Use after free in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96324 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105273 | 2026-10-16 | 7.5 High | ||
| MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input. | ||||
| CVE-2026-21589 | 1 Atlassian | 20 Bamboo, Bamboo Data Center, Bamboo Server and 17 more | 2026-10-16 | 7.5 High |
| This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. | ||||
| CVE-2026-107621 | 2026-10-16 | 7.5 High | ||
| JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. | ||||
| CVE-2026-68571 | 2026-10-16 | N/A | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-64959 | 2026-10-16 | N/A | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-63618 | 2026-10-16 | 7.5 High | ||
| Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-97851 | 2026-10-16 | 9.1 Critical | ||
| The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database. | ||||
| CVE-2026-95183 | 2026-10-16 | N/A | ||
| An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content. | ||||
| CVE-2026-91830 | 2026-10-16 | N/A | ||
| The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions. | ||||