Export limit exceeded: 28943 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (28943 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75995 | 2026-10-13 | 8.4 High | ||
| ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-105900 | 2026-10-13 | 7.5 High | ||
| ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-78628 | 2026-10-13 | 6 Medium | ||
| The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs. | ||||
| CVE-2026-85473 | 2026-10-13 | 5.3 Medium | ||
| The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service. | ||||
| CVE-2026-14909 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 6.5 Medium |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled. | ||||
| CVE-2026-95630 | 1 Adobe | 3 Adobe Commerce, Adobe Commerce B2b, Magento Open Source | 2026-10-13 | 4.3 Medium |
| Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-88834 | 2 Busybox, Redhat | 2 Busybox, Hummingbird | 2026-10-13 | 3.7 Low |
| A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected. | ||||
| CVE-2026-106626 | 2026-10-13 | 9.1 Critical | ||
| Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-105895 | 2026-10-13 | 9.9 Critical | ||
| Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-52394 | 2026-10-13 | 9.1 Critical | ||
| DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | ||||
| CVE-2026-109335 | 1 Surrealdb | 1 Surrealdb | 2026-10-13 | 6.5 Medium |
| SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values. | ||||
| CVE-2026-109325 | 1 Getgrav | 1 Grav | 2026-10-13 | 7.5 High |
| Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries. | ||||
| CVE-2026-109315 | 1 Getgrav | 1 Grav | 2026-10-13 | 6.5 Medium |
| Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries. | ||||
| CVE-2026-97805 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-79609 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary. | ||||
| CVE-2026-83798 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 5.5 Medium |
| Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally. | ||||
| CVE-2026-105719 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 6.5 Medium |
| Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-105718 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 8.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105717 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-13 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102867 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-13 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||