Export limit exceeded: 13555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 15221 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15221 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-16958 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 6.5 Medium
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
CVE-2026-16951 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 6.7 Medium
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.
CVE-2026-16946 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 7.8 High
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap buffer overflow.
CVE-2026-16944 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 6.7 Medium
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-16943 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 8.2 High
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a heap-based buffer overflow.
CVE-2026-16936 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 8.8 High
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-16934 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 8.8 High
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap-based buffer overflow.
CVE-2026-16845 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 9.8 Critical
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
CVE-2026-16847 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 8.8 High
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
CVE-2026-16855 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 5.5 Medium
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to a heap buffer overflow.
CVE-2026-16862 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 9.8 Critical
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
CVE-2026-16825 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 4.2 Medium
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
CVE-2026-16840 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 9.8 Critical
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
CVE-2026-16841 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 8.8 High
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
CVE-2026-16864 1 Ibm 3 Aix, Powervm Vios, Vios 2026-08-24 9.8 Critical
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
CVE-2024-22373 2 Fedoraproject, Malaterre 2 Fedora, Grassroots Dicom 2026-08-24 8.1 High
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2026-74990 1 Mozilla 2 Firefox, Thunderbird 2026-08-24 9.8 Critical
Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74987 1 Mozilla 2 Firefox, Thunderbird 2026-08-24 9.8 Critical
Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74949 1 Mozilla 2 Firefox, Thunderbird 2026-08-24 8.8 High
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74470 1 Linux 1 Linux Kernel 2026-08-23 7.8 High
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000.