Export limit exceeded: 424737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 424737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (424737 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-126798 2026-11-11 4.7 Medium
NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.
CVE-2026-126797 2026-11-11 9.8 Critical
NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.
CVE-2026-125926 1 Aws 1 Mcp-gateway-registry 2026-11-11 8.5 High
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request. To remediate this issue, users should upgrade to version 1.35.0.
CVE-2026-118288 1 Microsoft 2 Azure File Sync, Azure File Sync V22 2026-11-11 7 High
Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.
CVE-2026-118740 1 Microsoft 2 Aspire.dashboard.sdk.linux-x64, Aspire Dashboard 2026-11-11 9.1 Critical
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-118741 1 Microsoft 7 Microsoft.dotnet-scaffold, Microsoft.dotnet-scaffold-aspnet, Microsoft.dotnet.web.projecttemplates.10.0 and 4 more 2026-11-11 8.1 High
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-116721 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 6.5 Medium
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-116926 1 Microsoft 1 Teams 2026-11-11 7.5 High
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-116930 1 Microsoft 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more 2026-11-11 8.8 High
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-116936 1 Microsoft 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more 2026-11-11 7.2 High
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-118103 1 Microsoft 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more 2026-11-11 6.5 Medium
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2026-118296 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118302 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118701 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118706 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118707 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118708 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118710 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118712 1 Microsoft 6 365 Apps, Office 2021, Office 2024 and 3 more 2026-11-11 8.8 High
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-105562 1 Microsoft 14 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 11 more 2026-11-11 4.7 Medium
Time-of-check time-of-use (toctou) race condition in Windows Container Manager Service allows an authorized attacker to disclose information locally.