Export limit exceeded: 412897 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412897 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-88136 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 8.8 High |
| Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-88140 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 5.5 Medium |
| Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111986 | 1 Automatic1111 | 1 Stable-diffusion-webui | 2026-10-18 | 6.3 Medium |
| A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-83705 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83892 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 5.5 Medium |
| Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-85815 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-85822 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85825 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7 High |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85832 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83714 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83877 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 7.8 High |
| Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70566 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83902 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85842 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-18 | 7.8 High |
| Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85851 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-18 | 7.8 High |
| Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83903 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-112059 | 1 Liblas | 1 Liblas | 2026-10-18 | 6.1 Medium |
| libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes. | ||||
| CVE-2026-96534 | 2026-10-18 | 7.7 High | ||
| The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks. | ||||
| CVE-2026-111931 | 1 Coder | 1 Coder | 2026-10-18 | 4.3 Medium |
| Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing. | ||||
| CVE-2026-111926 | 1 Coder | 1 Coder | 2026-10-18 | 3.3 Low |
| Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens. | ||||