Export limit exceeded: 425938 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425938 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96174 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-11-14 | 7.8 High |
| Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-82177 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-11-14 | 7.2 High |
| Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance. | ||||
| CVE-2025-53700 | 2 Johnson Controls, Johnsoncontrols | 10 Istar Edge G2, Istar Ultra, Istar Ultra G2 and 7 more | 2026-11-14 | N/A |
| CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02. | ||||
| CVE-2026-96052 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 7.8 High |
| Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96058 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 4.6 Medium |
| Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack. | ||||
| CVE-2026-96992 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 6.4 Medium |
| Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-88237 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 7 High |
| Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95896 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally. | ||||
| CVE-2026-95908 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-11-14 | 5.5 Medium |
| Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96007 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96019 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96153 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96969 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 7 High |
| Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-127031 | 2026-11-14 | N/A | ||
| In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors. Details: - Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`. - Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator. - `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there. - Present since the initial import of the code base (commit `cc9da52`). - Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `""` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost. | ||||
| CVE-2026-82174 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-11-14 | 4.3 Medium |
| Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing. | ||||
| CVE-2026-112750 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-112758 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-112761 | 1 Microsoft | 15 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 12 more | 2026-11-14 | 7 High |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88212 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.5 High |
| Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-116426 | 1 Dell | 1 Powerscale Insightiq | 2026-11-14 | 4.3 Medium |
| Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. | ||||