Export limit exceeded: 424726 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424726 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424726 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (424726 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-100359 1 Suitecrm 1 Suitecrm 2026-11-10 6.5 Medium
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-100360 1 Suitecrm 1 Suitecrm 2026-11-10 5.4 Medium
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-100361 1 Suitecrm 1 Suitecrm 2026-11-10 7.1 High
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-100362 1 Suitecrm 1 Suitecrm 2026-11-10 5.3 Medium
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-122474 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 5.9 Medium
Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-122297 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 5.5 Medium
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
CVE-2026-122183 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-122182 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally.
CVE-2026-122179 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
CVE-2026-122177 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.5 High
Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-122175 1 Microsoft 1 Windows 11 26h1 2026-11-10 7 High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVE-2026-122174 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
CVE-2026-122173 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 6.8 Medium
Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-122172 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
CVE-2026-122170 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7 High
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-122169 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.5 High
Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
CVE-2026-122168 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVE-2026-122167 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 6.8 Medium
Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-122166 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
CVE-2026-122165 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-11-10 7.8 High
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.