Export limit exceeded: 424950 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 30275 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30275 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70267 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 7.2 High |
| Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-85891 | 1 Microsoft | 1 Azure Hdinsights | 2026-10-13 | 7.5 High |
| Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-105732 | 1 Microsoft | 1 Windows Sysinternals Suite | 2026-10-13 | 7.3 High |
| Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105725 | 1 Microsoft | 1 Windows Security App | 2026-10-13 | 7 High |
| Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-84290 | 2 Ibm, Microsoft | 2 Guardium Data Protection, Windows | 2026-10-13 | 5.1 Medium |
| IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads. | ||||
| CVE-2025-67792 | 2 Drivelock, Microsoft | 2 Drivelock, Windows | 2026-10-13 | 8.8 High |
| An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers. | ||||
| CVE-2025-68118 | 2 Freerdp, Microsoft | 2 Freerdp, Windows | 2026-10-13 | 9.1 Critical |
| FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms. The function `freerdp_certificate_data_hash_ uses` the Microsoft-specific `_snprintf` function to format certificate cache filenames without guaranteeing NUL termination when truncation occurs. According to Microsoft documentation, `_snprintf` does not append a terminating NUL byte if the formatted output exceeds the destination buffer size. If an attacker controls the hostname value (for example via server redirection or a crafted .rdp file), the resulting filename buffer may not be NUL-terminated. Subsequent string operations performed on this buffer may read beyond the allocated memory region, resulting in a heap-based out-of-bounds read. In default configurations, the connection is typically terminated before sensitive data can be meaningfully exposed, but unintended memory read or a client crash may still occur under certain conditions. Version 3.20.0 has a patch for the issue. | ||||
| CVE-2012-2524 | 1 Microsoft | 1 Office | 2026-10-09 | N/A |
| Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Computer Graphics Metafile (CGM) file, aka "CGM File Format Memory Corruption Vulnerability." | ||||
| CVE-2011-3389 | 9 Canonical, Debian, Google and 6 more | 21 Ubuntu Linux, Debian Linux, Chrome and 18 more | 2026-10-09 | N/A |
| The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. | ||||
| CVE-2004-0230 | 7 Juniper, Mcafee, Microsoft and 4 more | 12 Junos, Network Data Loss Prevention, Windows 2000 and 9 more | 2026-10-09 | N/A |
| TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. | ||||
| CVE-2015-2467 | 1 Microsoft | 1 Office | 2026-10-09 | N/A |
| Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." | ||||
| CVE-2015-2466 | 1 Microsoft | 1 Office | 2026-10-09 | N/A |
| Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted template, aka "Microsoft Office Remote Code Execution Vulnerability." | ||||
| CVE-2000-1200 | 1 Microsoft | 1 Windows Nt | 2026-10-09 | N/A |
| Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users. | ||||
| CVE-2026-106376 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-09 | 4.7 Medium |
| Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-94510 | 1 Microsoft | 1 Bookings | 2026-10-09 | 9.9 Critical |
| Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-83943 | 1 Microsoft | 1 Azure Api Center | 2026-10-09 | 8.7 High |
| Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-77900 | 1 Microsoft | 1 Azure App Service | 2026-10-09 | 9.8 Critical |
| Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105794 | 1 Microsoft | 1 Msquic | 2026-10-09 | N/A |
| MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1. | ||||
| CVE-2026-105795 | 1 Microsoft | 3 Kiota, Microsoft.openapi.kiota, Microsoft.openapi.kiota.builder | 2026-10-09 | 3.1 Low |
| Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0. | ||||
| CVE-2026-105796 | 1 Microsoft | 3 Kiota, Microsoft.openapi.kiota, Microsoft.openapi.kiota.builder | 2026-10-09 | 8.8 High |
| Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text outside a generated documentation comment. The Java sanitizer also removes non-ASCII characters after deleting terminators, which can create a new terminator during normalization. Exploitation requires a developer or build pipeline to generate source from the malicious description and then compile and load the Java output or load the PHP output, after which injected code executes in the consuming application or build environment context. The version range is based on the Java defect and does not assert that PHP generation existed in every affected release. This issue is fixed in version 1.35.0. | ||||