Export limit exceeded: 407578 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407578 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105008 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9 Critical |
| No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-104343 | 2026-10-13 | 5.5 Medium | ||
| Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103857 | 2026-10-13 | 5.5 Medium | ||
| Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103856 | 2026-10-13 | 5.5 Medium | ||
| Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-78632 | 2026-10-13 | 5.3 Medium | ||
| The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token. | ||||
| CVE-2026-105443 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 8.2 High |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. | ||||
| CVE-2026-100209 | 1 Microsoft | 5 365 Apps, Office 2024, Office 365 and 2 more | 2026-10-13 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78633 | 2026-10-13 | 6.5 Medium | ||
| The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests. | ||||
| CVE-2026-107369 | 2026-10-13 | 6.1 Medium | ||
| The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain. | ||||
| CVE-2026-11713 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 5.4 Medium |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled. | ||||
| CVE-2026-14532 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 4.3 Medium |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception. | ||||
| CVE-2026-85473 | 2026-10-13 | 5.3 Medium | ||
| The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service. | ||||
| CVE-2026-14909 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 6.5 Medium |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled. | ||||
| CVE-2026-77093 | 2026-10-13 | N/A | ||
| CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale | ||||
| CVE-2026-102699 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702. | ||||
| CVE-2026-88833 | 2 Busybox, Redhat | 2 Busybox, Hummingbird | 2026-10-13 | 6.5 Medium |
| A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity. | ||||
| CVE-2026-109828 | 1 Libsndfile | 1 Libsndfile | 2026-10-13 | 4.3 Medium |
| A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-74030 | 1 Wazuh | 3 Wazuh, Wazuh-agent, Wazuh-manager | 2026-10-13 | 4.9 Medium |
| Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group. | ||||
| CVE-2026-79607 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data. | ||||
| CVE-2026-110249 | 1 Mozilla | 1 Thunderbird | 2026-10-13 | 5.3 Medium |
| A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5. | ||||