Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413505 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92715 | 2 Themeum, Wordpress-extensions | 2 Tutor Lms – Elearning And Online Course Solution, Tutor Lms | 2026-10-18 | 4.3 Medium |
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert. | ||||
| CVE-2026-93515 | 1 X.org | 1 X Server | 2026-10-18 | 6.1 Medium |
| A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure. | ||||
| CVE-2026-93517 | 1 X.org | 1 X Server | 2026-10-18 | 7.8 High |
| A flaw was found in xorg-x11-server. The GLX (OpenGL Extension to the X Window System) interface fails to verify that incoming data sizes do not exceed allocated buffer limits when handling large rendering requests. An authenticated local client can exploit this vulnerability by sending a specially crafted request, triggering a heap-based buffer overflow. Successful exploitation can result in arbitrary code execution with the privileges of the X server or cause a Denial of Service (DoS) by crashing the application. | ||||
| CVE-2026-93523 | 1 X.org | 1 X Server | 2026-10-18 | 7.8 High |
| A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that can lead to a denial of service (DoS) or potential arbitrary code execution. | ||||
| CVE-2026-93524 | 1 X.org | 1 X Server | 2026-10-18 | 3.3 Low |
| A flaw was found in xorg-x11-server. An authenticated local user can trigger an out-of-bounds heap memory read by sending specially crafted X Keyboard Extension (XKB) requests with inconsistent key range parameters. This flaw leads to information disclosure, allowing the user to read sensitive data from the server's heap memory. | ||||
| CVE-2026-93516 | 1 X.org | 1 X Server | 2026-10-18 | 7.8 High |
| A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code execution or a Denial of Service (DoS) via an X server crash. | ||||
| CVE-2026-97820 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97825 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-98729 | 1 Linux | 1 Linux Kernel | 2026-10-18 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits() adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at teardown. This can be triggered on Carrizo and FX-8370E, both hstates. Pass the file to get_align_bits() and skip the randomisation for hugetlbfs. [ bp: Massage commit message. ] | ||||
| CVE-2026-98730 | 1 Linux | 1 Linux Kernel | 2026-10-18 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry. | ||||
| CVE-2026-97827 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-83869 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 9.8 Critical |
| Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97370 | 1 Junrar | 1 Junrar | 2026-10-18 | 7.5 High |
| Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1. | ||||
| CVE-2026-85375 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85829 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85327 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96245 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.5 High |
| Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-96521 | 1 Adobe | 1 Photoshop | 2026-10-18 | 7.8 High |
| Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-98436 | 1 Linux | 1 Linux Kernel | 2026-10-18 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly. | ||||
| CVE-2026-85823 | 1 Microsoft | 11 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 8 more | 2026-10-18 | 7 High |
| Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. | ||||