Export limit exceeded: 424715 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (424715 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-100361 1 Suitecrm 1 Suitecrm 2026-11-10 7.1 High
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-100362 1 Suitecrm 1 Suitecrm 2026-11-10 5.3 Medium
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-122474 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 5.9 Medium
Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-122297 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 5.5 Medium
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
CVE-2026-122183 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-122182 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally.
CVE-2026-122179 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
CVE-2026-122177 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.5 High
Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-122175 1 Microsoft 1 Windows 11 26h1 2026-11-10 7 High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVE-2026-122174 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
CVE-2026-122173 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 6.8 Medium
Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-122172 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
CVE-2026-122170 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-122169 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.5 High
Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
CVE-2026-122168 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVE-2026-122167 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 6.8 Medium
Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-122166 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
CVE-2026-122165 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
CVE-2026-122164 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 8 High
Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
CVE-2026-122162 1 Microsoft 5 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 2 more 2026-11-10 5.5 Medium
Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.