Export limit exceeded: 424742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (424742 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96107 1 Microsoft 9 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 6 more 2026-11-10 7 High
Null pointer dereference in Windows Phone Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96103 1 Microsoft 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more 2026-11-10 7.8 High
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-96097 1 Microsoft 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more 2026-11-10 7 High
Release of invalid pointer or reference in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
CVE-2026-96093 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 4.7 Medium
Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally.
CVE-2026-33379 1 Grafana 2 Grafana, Grafana Enterprise 2026-11-10 8.5 High
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
CVE-2026-96088 1 Microsoft 7 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 4 more 2026-11-10 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
CVE-2026-96086 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-11-10 6.5 Medium
Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network.
CVE-2026-19877 1 Infinitt Healthcare 1 Infinitt Ulite 2026-11-10 7.5 High
INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.
CVE-2026-19876 1 Infinitt Healthcare 1 Infinitt Ulite 2026-11-10 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.
CVE-2026-96076 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Use after free in Windows DIAL Client allows an authorized attacker to elevate privileges locally.
CVE-2026-96075 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-11-10 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally.
CVE-2026-96074 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-96073 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-11-10 7 High
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-124635 1 Kevquirk 1 Pureblog 2026-11-10 4.7 Medium
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVE-2026-96061 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-124622 1 Olivier-ls 1 Php-fts 2026-11-10 5.3 Medium
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."
CVE-2026-124590 1 Zhangbw409 1 Library Manager System 2026-11-10 7.3 High
A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-124586 1 Tencent 1 Rapidjson 2026-11-10 7.3 High
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-96060 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-124581 1 Itsourcecode 1 Airline Reservation System 2026-11-10 7.3 High
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.