Export limit exceeded: 100453 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (100453 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78447 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-13 | 7.8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83973 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-13 | 7.8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83982 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-13 | 7.8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83997 | 1 Microsoft | 15 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 12 more | 2026-09-13 | 8.1 High |
| Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-75863 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 7.8 High |
| Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-82006 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 7.8 High |
| Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-82007 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 7.8 High |
| Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-82005 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 7.8 High |
| Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-76199 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 8.6 High |
| Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-75862 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 7.8 High |
| Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-75771 | 3 Adobe, Apple, Microsoft | 5 Photoshop, Photoshop 2025, Photoshop 2026 and 2 more | 2026-09-13 | 7.8 High |
| Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-78574 | 1 Okta | 1 Okta Hyperdrive Integration Plugin | 2026-09-13 | 7.5 High |
| The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer. | ||||
| CVE-2026-85983 | 1 Auth0 | 1 Ad/ldap Connector | 2026-09-13 | 7.8 High |
| The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account. | ||||
| CVE-2026-81975 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-13 | 7.8 High |
| Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-80161 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-13 | 7.8 High |
| Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-81986 | 3 Adobe, Apple, Microsoft | 6 Acrobat, Acrobat 2024, Acrobat Dc and 3 more | 2026-09-13 | 7.8 High |
| Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-79907 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-13 | 7.8 High |
| Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-81990 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-13 | 7.8 High |
| Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-53938 | 1 Openidc | 1 Cjose | 2026-09-13 | 8.2 High |
| OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the length of the attacker-supplied `encrypted_key` (JWE Encrypted Key) before unwrapping it into a fixed-size, heap-allocated Content Encryption Key (CEK) buffer. A remote, unauthenticated attacker who can submit a crafted JWE to an application that decrypts it with an AES-KW symmetric key can trigger an out-of-bounds heap write, corrupting the heap. This leads at minimum to a crash (denial of service) and, depending on the heap layout and allocator, may be leverageable for further memory-corruption impact. `cjose_jwe_import()` / `cjose_jwe_decrypt()` are pre-authentication entry points: they parse and process fully attacker-controlled input. Upgrade to cjose 0.6.2.5 to receive a patch. If upgrading is not immediately possible, reject the AES Key Wrap algorithms (`A128KW`/`A192KW`/`A256KW`) for untrusted JWEs at the application layer. | ||||
| CVE-2026-76801 | 2 Fireplugins, Wordpress | 2 Firebox – Woocommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment, Wordpress | 2026-09-13 | 8.8 High |
| The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_contents, combined with no sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, lowering the effective entry point to Author-level access. | ||||