Export limit exceeded: 408827 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408827 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408827 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79609 | 1 Xen | 1 Xen | 2026-10-13 | N/A |
| XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary. | ||||
| CVE-2026-55695 | 1 Fearlessgeekmedia | 1 Fearlesscms | 2026-10-13 | 9.1 Critical |
| FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor. This issue is fixed in version 0.1.3b. | ||||
| CVE-2026-83646 | 1 Microsoft | 6 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 3 more | 2026-10-13 | 4.8 Medium |
| Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-81964 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more | 2026-10-13 | 5.5 Medium |
| Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-70580 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-13 | 8.8 High |
| Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. | ||||
| CVE-2026-70280 | 1 Microsoft | 7 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 4 more | 2026-10-13 | 4.4 Medium |
| Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-76282 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 8.8 High |
| Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-102865 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 6.5 Medium |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-102863 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 8.8 High |
| Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-102860 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 8.8 High |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-76283 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 7.6 High |
| Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-76284 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 9.8 Critical |
| Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-76285 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-13 | 9.8 Critical |
| Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information. | ||||
| CVE-2026-103572 | 1 Microsoft | 2 Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-13 | 8.8 High |
| Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70414 | 1 Dell | 2 Command\|configure, Command|configure | 2026-10-13 | 5.5 Medium |
| Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure. | ||||
| CVE-2026-100762 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 9.6 Critical |
| Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-100763 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | 9.1 Critical |
| Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | ||||
| CVE-2026-102404 | 1 Elastic | 1 Elasticsearch | 2026-10-13 | 6.5 Medium |
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability. | ||||
| CVE-2026-110240 | 1 Lancet Project | 1 Lancet | 2026-10-13 | 4.8 Medium |
| Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints. | ||||
| CVE-2026-110232 | 2026-10-13 | 3.3 Low | ||
| Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive. | ||||