Export limit exceeded: 410594 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410594 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410594 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97838 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-20 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-105453 | 1 Ibm | 1 Sterling Connect Direct | 2026-10-19 | 8.4 High |
| IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management. | ||||
| CVE-2026-97831 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97828 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-19 | 6.5 Medium |
| Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-96238 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 6.5 Medium |
| Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-96237 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.5 High |
| Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96230 | 1 Microsoft | 3 Microsoft.aspnetcore.components.webassembly.server, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 8.8 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96233 | 1 Microsoft | 2 .net, .net Framework | 2026-10-19 | 7.5 High |
| Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96225 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.8 High |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96231 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.8 High |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70007 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-19 | 8.8 High |
| Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-107366 | 1 Ibm | 1 Langflow Oss | 2026-10-19 | 8.3 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID. | ||||
| CVE-2026-96236 | 1 Microsoft | 3 Asp.net Core, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 7.5 High |
| Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-107400 | 1 Ibm | 1 Tririga Application Platform | 2026-10-19 | 8.8 High |
| IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. | ||||
| CVE-2026-70165 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-19 | 6.7 Medium |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-110673 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-19 | N/A |
| Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth. | ||||
| CVE-2026-112893 | 1 Python-pillow | 1 Pillow | 2026-10-19 | 7.5 High |
| Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112894 | 1 Python-pillow | 1 Pillow | 2026-10-19 | 7.5 High |
| Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112895 | 1 Python-pillow | 1 Pillow | 2026-10-19 | 7.5 High |
| Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112896 | 1 Python-pillow | 1 Pillow | 2026-10-19 | N/A |
| Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0. | ||||