Export limit exceeded: 10266 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10266 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-102202 1 Microsoft 7 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 4 more 2026-10-13 7.8 High
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-100214 1 Microsoft 2 Dynamics Nav 2017, Dynamics Nav 2018 2026-10-13 8.8 High
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
CVE-2026-96911 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-96225 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96231 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70264 1 Microsoft 1 Windows Defender 2026-10-13 5.5 Medium
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.
CVE-2026-88133 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83659 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85900 1 Microsoft 1 Sharepoint Server 2026-10-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-70165 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 6.7 Medium
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69969 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 4.7 Medium
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
CVE-2026-85857 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 5.5 Medium
Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-85849 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85840 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 6.5 Medium
Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
CVE-2026-83793 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 7 High
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83704 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-44828 1 Qexo 1 Qexo 2026-10-13 N/A
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
CVE-2026-107857 1 Dongdongbh 1 Mindwtr 2026-10-13 4.4 Medium
Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.
CVE-2026-106504 2 Backstage, Linuxfoundation 4 Backstage, Plugin-scaffolder-backend, Backstage and 1 more 2026-10-13 6.5 Medium
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.
CVE-2026-11837 1 Redhat 8 Enterprise Linux, Enterprise Linux Eus, Openstack and 5 more 2026-10-13 7.3 High
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.