Export limit exceeded: 386985 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 26457 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (26457 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-45501 1 Microsoft 9 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 6 more 2026-07-08 6.5 Medium
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-45461 1 Microsoft 11 365 Apps, 365 Copilot, Microsoft 365 and 8 more 2026-07-08 8.4 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45460 1 Microsoft 10 365 Apps, 365 Copilot, Microsoft 365 and 7 more 2026-07-08 4.7 Medium
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-45458 1 Microsoft 13 365 Apps, Microsoft 365, Office 2019 and 10 more 2026-07-08 8.4 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45453 1 Microsoft 5 Sharepoint Enterprise Server 2016, Sharepoint Server, Sharepoint Server 2016 and 2 more 2026-07-08 5.4 Medium
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-44823 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-07-08 7.8 High
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-44820 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-07-08 7.8 High
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-44818 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-07-08 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-44817 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-07-08 7.8 High
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-45486 1 Microsoft 7 365 Apps, Microsoft 365, Office 2021 and 4 more 2026-07-08 7.8 High
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-45474 1 Microsoft 12 365 Apps, 365 Copilot, Microsoft 365 and 9 more 2026-07-08 8.4 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45472 1 Microsoft 13 365 Apps, 365 Copilot, Microsoft 365 and 10 more 2026-07-08 8.4 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-9182 3 Esri, Linux, Microsoft 3 Arcgis Server, Linux Kernel, Windows 2026-07-08 9.8 Critical
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.
CVE-2026-9181 3 Esri, Linux, Microsoft 3 Arcgis Server, Linux Kernel, Windows 2026-07-08 9.8 Critical
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integrity, and availability. This issue impacts all versions of ArcGIS Server on Windows and Linux 12.0 and prior. This issue does not impact ArcGIS Enterprise for Kubernetes.
CVE-2026-58290 1 Microsoft 1 Edge Chromium 2026-07-07 7.5 High
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-13020 4 Esri, Kubernetes, Linux and 1 more 4 Portal For Arcgis, Kubernetes, Linux Kernel and 1 more 2026-07-07 8.1 High
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.
CVE-2026-13019 4 Esri, Kubernetes, Linux and 1 more 4 Portal For Arcgis, Kubernetes, Linux Kernel and 1 more 2026-07-07 9.8 Critical
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API.
CVE-2026-57974 1 Microsoft 1 Edge Chromium 2026-07-07 8.8 High
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58523 2 Google, Microsoft 2 Android, Edge Chromium 2026-07-07 6.5 Medium
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-58298 1 Microsoft 1 Edge Chromium 2026-07-07 7.2 High
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.