Export limit exceeded: 415500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108333 | 2026-10-27 | 2.5 Low | ||
| Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-108307 | 2026-10-27 | 7.8 High | ||
| Tanium addressed a heap-based buffer overflow vulnerability in Index. | ||||
| CVE-2026-108331 | 2026-10-27 | 3.3 Low | ||
| Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-103576 | 1 Microsoft | 9 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 6 more | 2026-10-27 | 6.5 Medium |
| Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-87085 | 2026-10-27 | 6.5 Medium | ||
| Tanium addressed a SQL injection vulnerability in Provision. | ||||
| CVE-2026-117516 | 1 Oretnom23 | 1 Php-travel-agency-system | 2026-10-27 | 7.3 High |
| A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-90725 | 2026-10-27 | 4.9 Medium | ||
| Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. | ||||
| CVE-2026-104349 | 1 Adobe | 1 Creative Cloud Desktop Application | 2026-10-27 | 7.3 High |
| Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-76473 | 1 Cisco | 4 Cisco Unified Communications Manager, Emergency Responder, Unified Communications Manager Im And Presence Service and 1 more | 2026-10-27 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper neutralization of special elements in output used by a downstream component that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74. | ||||
| CVE-2026-103577 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-27 | 7.5 High |
| Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-116677 | 2026-10-27 | N/A | ||
| OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2. | ||||
| CVE-2026-105003 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-27 | 7.8 High |
| Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-117515 | 1 Oretnom23 | 1 Php-travel-agency-system | 2026-10-27 | 7.3 High |
| A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-111054 | 2026-10-27 | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-112374. Reason: This candidate is a duplicate of CVE-2026-112374. Notes: All CVE users should reference CVE-2026-112374 instead of this candidate. | ||||
| CVE-2026-87694 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-27 | 7.8 High |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-87695 | 1 Microsoft | 9 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 6 more | 2026-10-27 | 7.8 High |
| Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-87696 | 1 Microsoft | 6 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 3 more | 2026-10-27 | 7.5 High |
| Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-117514 | 1 Oretnom23 | 1 Php-travel-agency-system | 2026-10-27 | 7.3 High |
| A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-118018 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159. | ||||
| CVE-2026-118027 | 1 Mozilla | 1 Firefox | 2026-10-27 | N/A |
| Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | ||||