Export limit exceeded: 108000 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (108000 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85843 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.8 High |
| Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85846 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-29 | 7 High |
| Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85848 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.8 High |
| Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85849 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-29 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85850 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-10-29 | 7.8 High |
| Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85851 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-29 | 7.8 High |
| Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85853 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-10-29 | 7 High |
| Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85854 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-29 | 7 High |
| Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85855 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-29 | 7 High |
| Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85856 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.1 High |
| Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-85858 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-29 | 7.8 High |
| Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85860 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.8 High |
| Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85861 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-29 | 7.8 High |
| Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85863 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-29 | 7.8 High |
| Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-112438 | 1 Apple | 1 Macos | 2026-10-29 | 8.8 High |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root. | ||||
| CVE-2026-97206 | 1 Nlnetlabs | 1 Unbound | 2026-10-29 | 7.5 High |
| NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash. | ||||
| CVE-2026-92287 | 1 Apache | 2 Arrow C++, Pyarrow | 2026-10-29 | 8.1 High |
| Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious host set by an attacker in the file. Users are recommended to upgrade to version 26.0.0, which disables this behavior by default and requires that users opt-in to it by enabling the read_kms_url flag in the DecryptionConfiguration. Users of affected versions are recommended to either specify the KMS URL in the KmsConnectionConfig when reading files, or ensure any KmsClient implementations validate received KMS URLs. Users that opt-in to file-controlled KMS URLs in version 26.0.0 and later must ensure KmsClients validate KMS URLs. | ||||
| CVE-2026-91223 | 1 Oracle | 1 Soa Suite | 2026-10-29 | 8.8 High |
| Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-59179 | 1 Naorsabag | 1 Openhop | 2026-10-29 | 8.3 High |
| OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7. | ||||
| CVE-2026-59164 | 1 Getnora-io | 1 Nora | 2026-10-29 | 7.1 High |
| NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5. | ||||