Export limit exceeded: 425753 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425753 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109801 | 2026-11-10 | 6.5 Medium | ||
| SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system users. Successful exploitation results in a high impact on confidentiality, with no impact on integrity or availability of the application. | ||||
| CVE-2026-109794 | 2026-11-10 | 7.5 High | ||
| SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing excessive resource utilization and service disruption. This results in a high impact on availability. There is no impact on confidentiality and integrity. | ||||
| CVE-2026-109793 | 2026-11-10 | 7.5 High | ||
| SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity. | ||||
| CVE-2026-4897 | 2 Freedesktop, Redhat | 6 Polkit, Enterprise Linux, Hummingbird and 3 more | 2026-11-10 | 5.5 Medium |
| A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system. | ||||
| CVE-2026-69555 | 1 Microsoft | 1 Azure Arc | 2026-11-10 | 10 Critical |
| Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66798 | 1 Microsoft | 2 Edge, Edge Chromium | 2026-11-10 | 4.3 Medium |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-68798 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-66805 | 2 Microsoft, Redhat | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-11-10 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-67177 | 2026-11-10 | 5.4 Medium | ||
| Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17. | ||||
| CVE-2026-62757 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 5.3 Medium |
| Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-67176 | 2026-11-10 | 5.4 Medium | ||
| Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17. | ||||
| CVE-2026-68820 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-11-10 | 7 High |
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68807 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68800 | 1 Microsoft | 17 365 Apps, Excel, Excel 2016 and 14 more | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-67175 | 2026-11-10 | 4.6 Medium | ||
| Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17. | ||||
| CVE-2026-62878 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-11-10 | 9.8 Critical |
| Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62877 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 7.8 High |
| Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62740 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-105613 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-10 | 4.7 Medium |
| PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-40375 | 1 Microsoft | 8 Dynamics 365 Business Central 2023 Wave 2, Dynamics 365 Business Central 2024, Dynamics 365 Business Central 2024 Wave 1 and 5 more | 2026-11-10 | 6.5 Medium |
| Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | ||||