Export limit exceeded: 425933 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425933 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-88823 | 1 Openssl | 1 Openssl | 2026-11-14 | N/A |
| Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary. | ||||
| CVE-2026-88249 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 8.8 High |
| Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-94515 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-94522 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-94527 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95874 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Xbox allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96965 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.3 Medium |
| Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | ||||
| CVE-2026-97015 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 6.8 Medium |
| Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||||
| CVE-2026-95966 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95987 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95991 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96004 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 7 High |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-129267 | 1 Sergix44 | 1 Xbackbone | 2026-11-14 | 3.5 Low |
| A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-95894 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95902 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95905 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 6.8 Medium |
| Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-67637 | 1 Microsoft | 9 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more | 2026-11-14 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-66813 | 1 Microsoft | 12 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 (gdr) and 9 more | 2026-11-14 | 8.1 High |
| Out-of-bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-88187 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-14 | 8 High |
| Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-96973 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-14 | 7 High |
| Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. | ||||