Export limit exceeded: 10796 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 15511 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16698 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 399497 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (399497 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-71972 2 Denx, U-boot 2 U-boot, U-boot 2026-09-29 5.9 Medium
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.
CVE-2026-15278 2026-09-29 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-96878 1 Wikimedia 1 Mediawiki-cargo Extension 2026-09-29 N/A
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
CVE-2026-96877 1 Wikimedia 1 Mediawiki-cargo Extension 2026-09-29 N/A
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
CVE-2026-96874 1 Wikimedia 1 Mediawiki-cargo Extension 2026-09-29 N/A
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
CVE-2026-95384 1 Google 1 Chrome 2026-09-29 5.3 Medium
Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95359 1 Google 1 Chrome 2026-09-29 3.4 Low
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95332 1 Google 1 Chrome 2026-09-29 4.7 Medium
Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95324 1 Google 1 Chrome 2026-09-29 3.4 Low
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95308 1 Google 1 Chrome 2026-09-29 3.4 Low
Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95295 1 Google 1 Chrome 2026-09-29 4.6 Medium
Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chromium security severity: Medium)
CVE-2026-12345 1 Python 1 Cpython 2026-09-29 N/A
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
CVE-2026-102318 1 Google 1 Chrome 2026-09-29 4.7 Medium
Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-102315 1 Google 1 Chrome 2026-09-29 3.4 Low
Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-102311 1 Google 1 Chrome 2026-09-29 3.4 Low
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-102307 1 Google 1 Chrome 2026-09-29 4.7 Medium
Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95302 1 Google 1 Chrome 2026-09-29 2.9 Low
Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
CVE-2026-95314 1 Google 1 Chrome 2026-09-29 N/A
Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95325 1 Google 1 Chrome 2026-09-29 9.6 Critical
Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95347 1 Google 1 Chrome 2026-09-29 9.6 Critical
Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)