Export limit exceeded: 10214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10214 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65674 1 Microsoft 6 Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\), Microsoft Sql Server 2025 For X64-based Systems \(cu9\) and 3 more 2026-10-13 8.8 High
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-96857 1 Microsoft 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more 2026-10-13 5.5 Medium
Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.
CVE-2026-85900 1 Microsoft 1 Sharepoint Server 2026-10-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-70190 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 7.3 High
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70165 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 6.7 Medium
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-88137 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 6.5 Medium
Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.
CVE-2026-87697 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 8.8 High
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-88091 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2026-69969 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 4.7 Medium
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
CVE-2026-69673 1 Microsoft 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-85857 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 5.5 Medium
Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-85849 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85840 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 6.5 Medium
Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
CVE-2026-85812 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 5.5 Medium
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
CVE-2026-85343 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-83927 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.
CVE-2026-83793 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 7 High
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83704 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-44828 1 Qexo 1 Qexo 2026-10-13 N/A
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
CVE-2026-107857 1 Dongdongbh 1 Mindwtr 2026-10-13 4.4 Medium
Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.