Export limit exceeded: 413273 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413273 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413273 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413273 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85803 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-10-16 | 7 High |
| Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70021 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-16 | 7 High |
| Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-91142 | 1 Redhat | 3 Enterprise Linux, Openshift Dev Spaces, Openshift Devspaces | 2026-10-16 | 3.6 Low |
| A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts. | ||||
| CVE-2026-69942 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-16 | 7.8 High |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally. | ||||
| CVE-2026-69934 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-16 | 7.8 High |
| Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69923 | 1 Microsoft | 9 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 6 more | 2026-10-16 | 7.8 High |
| Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85926 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 8.1 High |
| Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69919 | 1 Microsoft | 9 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 6 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-103560 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-10-16 | 5.5 Medium |
| Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-111717 | 2026-10-16 | 4.3 Medium | ||
| Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs. | ||||
| CVE-2026-111714 | 1 Amauri | 1 Tarteaucitronjs | 2026-10-16 | 3.1 Low |
| tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked. | ||||
| CVE-2026-111712 | 2026-10-16 | 6.5 Medium | ||
| Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials. | ||||
| CVE-2026-111704 | 2026-10-16 | 9.8 Critical | ||
| LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data. | ||||
| CVE-2026-111699 | 2026-10-16 | 4.8 Medium | ||
| Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags. | ||||
| CVE-2026-111696 | 2026-10-16 | 6.5 Medium | ||
| data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials. | ||||
| CVE-2026-111694 | 2026-10-16 | 5.3 Medium | ||
| qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure. | ||||
| CVE-2026-111693 | 2026-10-16 | 9.8 Critical | ||
| DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes. | ||||
| CVE-2026-111689 | 1 Exrick | 1 Xboot | 2026-10-16 | 4.3 Medium |
| Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status. | ||||
| CVE-2026-111686 | 1 Thecosy | 1 Icecms | 2026-10-16 | 7.5 High |
| IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques. | ||||
| CVE-2026-111683 | 2026-10-16 | 5.4 Medium | ||
| Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks. | ||||