Export limit exceeded: 29031 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 15945 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 409216 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (409216 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-88096 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
CVE-2026-92629 1 Lenovo 1 Baiying Pc Client 2026-10-16 7.3 High
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2026-111450 2026-10-16 5.9 Medium
Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.
CVE-2026-111451 2026-10-16 7.8 High
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.
CVE-2026-110013 2026-10-16 4.8 Medium
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
CVE-2026-109898 2 Arraytics, Wordpress-extensions 2 Wp Event Solution, Wp Event Solution 2026-10-16 5.3 Medium
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
CVE-2026-97758 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-10-16 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97754 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-10-16 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97759 1 Microsoft 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more 2026-10-16 8.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-97762 1 Microsoft 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more 2026-10-16 8.8 High
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-96317 1 Microsoft 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more 2026-10-16 7.8 High
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-88098 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7 High
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
CVE-2026-88099 1 Microsoft 5 Windows Server 2019, Windows Server 2019 (server Core Installation), Windows Server 2022 and 2 more 2026-10-16 5.9 Medium
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CVE-2026-88100 1 Microsoft 9 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 6 more 2026-10-16 7.8 High
Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVE-2026-96318 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.8 High
Heap-based buffer overflow in Windows Resume allows an authorized attacker to elevate privileges locally.
CVE-2026-88101 1 Microsoft 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more 2026-10-16 7.8 High
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
CVE-2026-96319 1 Microsoft 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more 2026-10-16 7 High
Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-88102 1 Microsoft 5 Windows Server 2019, Windows Server 2019 (server Core Installation), Windows Server 2022 and 2 more 2026-10-16 9.8 Critical
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
CVE-2026-96320 1 Microsoft 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more 2026-10-16 9.8 Critical
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88103 1 Microsoft 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more 2026-10-16 7 High
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.