Export limit exceeded: 409245 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409245 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110149 | 1 Google | 1 Chrome | 2026-10-14 | 9.6 Critical |
| Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-88064 | 2 Backstage, Linuxfoundation | 3 Backstage, Backstage, Backstage Plugin-techdocs-node | 2026-10-14 | 8.8 High |
| Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the documentation generator and cause unintended code execution. The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4. | ||||
| CVE-2026-110148 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-110147 | 1 Google | 1 Chrome | 2026-10-14 | 8.8 High |
| Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-79957 | 2026-10-14 | 8.1 High | ||
| ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks. | ||||
| CVE-2026-105016 | 1 Microsoft | 10 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 and 7 more | 2026-10-14 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-110146 | 1 Google | 1 Chrome | 2026-10-14 | 6.5 Medium |
| Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-105013 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 7.4 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-70162 | 1 Microsoft | 3 Microsoft Visual Studio 2026 Version 18.10, System.security.cryptography.pkcs, Visual Studio 2022 | 2026-10-14 | 5.9 Medium |
| A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests. | ||||
| CVE-2026-105009 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-14 | 7.5 High |
| Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103558 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-14 | 7.5 High |
| Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-110145 | 1 Google | 1 Chrome | 2026-10-14 | 8.3 High |
| Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-110142 | 1 Google | 1 Chrome | 2026-10-14 | 9.6 Critical |
| Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-109712 | 1 Mozilla | 1 Firefox | 2026-10-14 | N/A |
| Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109715 | 1 Mozilla | 1 Firefox | 2026-10-14 | N/A |
| Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-70279 | 1 Microsoft | 3 Exchange Server 2016, Exchange Server 2019, Exchange Server Se | 2026-10-14 | 9.3 Critical |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-102870 | 1 Microsoft | 3 Microsoft.aspnetcore.components.webassembly.server, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-14 | 8.8 High |
| Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-58280 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-14 | 7.5 High |
| Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-102851 | 1 Microsoft | 1 Visual Studio Code | 2026-10-14 | 6.1 Medium |
| Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-110144 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-14 | 9.6 Critical |
| Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | ||||