Export limit exceeded: 389307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 389307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 389307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (389307 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-72993 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72992 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72991 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72990 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72988 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72995 1 Microsoft 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more 2026-09-08 7.8 High
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-72987 1 Microsoft 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more 2026-09-08 8.1 High
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
CVE-2026-69465 1 Microsoft 1 Sharepoint Server 2026-09-08 8.8 High
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-65772 1 Microsoft 1 Dynamics 365 2026-09-08 8.8 High
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
CVE-2026-72974 1 Microsoft 8 365 Apps, Office 2016, Office 2019 and 5 more 2026-09-08 6.5 Medium
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-70570 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 7.5 High
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
CVE-2026-70296 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 9.8 Critical
Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
CVE-2026-70203 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 8.8 High
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
CVE-2026-69441 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2026-09-08 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-69805 1 Microsoft 3 Diagnostics Runtime, Visual Studio 2022, Visual Studio 2026 2026-09-08 7.5 High
External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69439 1 Microsoft 3 .net, Visual Studio 2022, Visual Studio 2026 2026-09-08 8.8 High
Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69632 1 Microsoft 7 365 Apps, Office 2019, Office 2021 and 4 more 2026-09-08 8.8 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVE-2026-19887 2 Uscnanbu, Wordpress 2 Welcart E-commerce, Wordpress 2026-09-08 8.8 High
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.
CVE-2026-69629 1 Microsoft 5 365 Apps, Office 2019, Office 2021 and 2 more 2026-09-08 8.8 High
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-18021 2 Beaverbuilder, Wordpress 2 Beaver Builder Page Builder – Drag And Drop Website Builder, Wordpress 2026-09-08 6.5 Medium
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.