Export limit exceeded: 408065 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408065 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97017 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97753 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97750 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96997 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 7.8 High |
| Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-97744 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-97001 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-97749 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-13 | 9.8 Critical |
| Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97005 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-96996 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-96995 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-10-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-97012 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-13 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96943 | 1 Microsoft | 1 Raw Image Extension | 2026-10-13 | 8.8 High |
| Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96935 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-85886 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-10-13 | 8.5 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-83945 | 1 Microsoft | 4 Microsoft Sql Server 2022 For X64-based Systems \(cu27\), Microsoft Sql Server 2025 For X64-based Systems \(cu9\), Sql Server 2022 and 1 more | 2026-10-13 | 6.6 Medium |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-96956 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-10-13 | 8 High |
| Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-106170 | 1 Fortinet | 1 Fortisandbox | 2026-10-13 | 4.8 Medium |
| An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. | ||||
| CVE-2026-19940 | 1 Zephyrproject | 1 Zephyr | 2026-10-13 | 6.5 Medium |
| The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then clears ag->acl_conn, which marks the pool slot as free — but it leaves ag->ongoing_call_work (and ag->slc_work) untouched. The next connection that lands on the same slot enters hfp_ag_create(), whose only occupancy test is ag->acl_conn, and immediately executes memset(ag, 0, sizeof(struct bt_hfp_ag)) followed by k_work_init_delayable(). Zeroing and re-initialising a k_work_delayable whose struct _timeout node is still linked into the kernel timeout list leaves the kernel holding a reference to a node with NULL prev/next links. ag->ongoing_call_work is armed by the remote peer: when a Hands-Free unit sends AT+CIND? during Service Level Connection establishment and the application provides the asynchronous get_ongoing_call callback, the AG schedules the work for CONFIG_BT_HFP_AG_GET_ONGOING_CALL_TIMEOUT milliseconds (default 10000). The timer is cancelled only if the application answers in time via bt_hfp_ag_ongoing_calls(). A peer that sends AT+CIND?, then disconnects the HFP RFCOMM DLC, then immediately re-opens it on the same ACL link, reuses the same pool slot deterministically while the timeout is still pending — the AG's RFCOMM server accept path (hfp_ag_accept()) calls hfp_ag_create() directly, so the remote side drives both teardown and re-creation. The result is corruption of the kernel's timeout list: sys_dlist_remove() on the zeroed node performs writes through NULL pointers from the clock-announce path, and rescheduling the re-initialised work re-inserts a node the list already references, creating a cycle that the announce loop walks with interrupts locked. The observable impact is a fault or hang of the whole system, i.e. a denial of service reachable from Bluetooth radio range; no attacker-controlled data is written, so this does not by itself yield code execution. Exposure is limited to builds with CONFIG_BT_HFP_AG (marked experimental and disabled by default) whose application implements the asynchronous get_ongoing_call callback. | ||||
| CVE-2026-104587 | 2026-10-13 | N/A | ||
| blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface. | ||||
| CVE-2026-100761 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 8.8 High |
| Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||