Export limit exceeded: 389924 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (389924 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-69589 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69583 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69375 1 Microsoft 3 Exchange Server 2016, Exchange Server 2019, Exchange Server Se 2026-09-08 6.5 Medium
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
CVE-2026-17259 1 Ibm 1 I 2026-09-08 4.3 Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.
CVE-2026-69366 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 7.1 High
Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network.
CVE-2026-69296 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 7.1 High
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-69281 1 Microsoft 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more 2026-09-08 7 High
Use after free in Windows License Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-68841 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-68835 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 7.1 High
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
CVE-2026-68785 1 Microsoft 4 Sql Server 2017, Sql Server 2019, Sql Server 2022 and 1 more 2026-09-08 4.9 Medium
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67368 1 Microsoft 4 Sql Server 2017, Sql Server 2019, Sql Server 2022 and 1 more 2026-09-08 8.8 High
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62895 1 Microsoft 1 Azure Arc Sql Server Extension 2026-09-08 8.8 High
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-17270 1 Ibm 1 I 2026-09-08 4.3 Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.
CVE-2026-64371 1 Linux 1 Linux Kernel 2026-09-08 5.5 Medium
In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (part 1) Fix the easy cases where procfs currently calls ptrace_may_access() without exec_update_lock protection, where the fix is to simply add the extra lock or use mm_access(): - do_task_stat(): grab exec_update_lock - proc_pid_wchan(): grab exec_update_lock - proc_map_files_lookup(): use mm_access() instead of get_task_mm() - proc_map_files_readdir(): use mm_access() instead of get_task_mm() - proc_ns_get_link(): grab exec_update_lock - proc_ns_readlink(): grab exec_update_lock
CVE-2026-79418 1 Emxtecnologia 1 Gestao X Business Suite 2026-09-08 5.4 Medium
EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other authenticated users, potentially resulting in session hijacking, account takeover, and unauthorized actions.
CVE-2021-44319 1 Parrot 1 Ar.drone 2026-09-08 7.5 High
Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.
CVE-2025-67066 1 Oasys 1 Sysoa 2026-09-08 9.8 Critical
SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path
CVE-2026-86730 1 Craftcms 2 Cms, Craft Cms 2026-09-08 8.8 High
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
CVE-2026-62916 1 Microsoft 2 Entra Id, Microsoft Entra Id 2026-09-08 9.1 Critical
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-78583 1 Elastic 1 Kibana 2026-09-08 8.1 High
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.