Export limit exceeded: 413870 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (413870 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-79865 2026-10-23 9.6 Critical
No description provided
CVE-2026-79866 2026-10-23 9.6 Critical
No description provided
CVE-2026-79867 2026-10-23 9.6 Critical
No description provided
CVE-2026-79868 2026-10-23 9.6 Critical
No description provided
CVE-2026-79871 2026-10-23 9.6 Critical
No description provided
CVE-2026-79875 2026-10-23 9.3 Critical
No description provided
CVE-2026-79878 2026-10-23 8.8 High
No description provided
CVE-2026-79879 2026-10-23 8.8 High
No description provided
CVE-2026-79883 2026-10-23 8.3 High
No description provided
CVE-2026-79884 2026-10-23 8.2 High
No description provided
CVE-2026-79889 2026-10-23 8.1 High
No description provided
CVE-2026-79892 2026-10-23 7.8 High
No description provided
CVE-2026-79895 2026-10-23 7.5 High
No description provided
CVE-2026-115349 2 Lepture, Mistune Project 2 Mistune, Mistune 2026-10-23 7.5 High
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
CVE-2026-115371 2 Linuxcontainers, Lxc 2 Incus, Incus 2026-10-23 7.1 High
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
CVE-2026-101797 1 Oracle 2 Mysql Cluster, Mysql Server 2026-10-23 7.5 High
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2026-115391 1 Bytecodealliance 1 Wasmtime 2026-10-23 5.8 Medium
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
CVE-2026-115395 2 Nationalsecurityagency, Nsa 2 Ghidra, Ghidra 2026-10-23 5.5 Medium
Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space to deny service to the host.
CVE-2026-115396 2 Nationalsecurityagency, Nsa 2 Ghidra, Ghidra 2026-10-23 5.5 Medium
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
CVE-2026-115397 2 Nationalsecurityagency, Nsa 2 Ghidra, Ghidra 2026-10-23 5.5 Medium
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.