Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425863 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95692 | 1 Openssl | 1 Openssl | 2026-11-14 | N/A |
| Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected. Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV. CWE: CWE-125: Out-of-bounds Read Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length. The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery. Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application. FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm. | ||||
| CVE-2026-96054 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-96064 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 8.8 High |
| Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-96078 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96084 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 7.8 High |
| Heap-based buffer overflow in Graphic Fonts allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96041 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96060 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7.8 High |
| Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96067 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 9.8 Critical |
| Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96086 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-11-14 | 6.5 Medium |
| Out-of-bounds read in Windows WLAN Service allows an unauthorized attacker to deny service over an adjacent network. | ||||
| CVE-2026-96093 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 4.7 Medium |
| Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-120788 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-129261 | 1 Kingston | 1 Fury Ctrl Rgb Control Software | 2026-11-14 | 8.2 High |
| A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioctl with insufficient access control. The attack is only possible with local access. | ||||
| CVE-2026-127031 | 2026-11-14 | N/A | ||
| In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors. Details: - Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`. - Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator. - `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there. - Present since the initial import of the code base (commit `cc9da52`). - Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `""` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost. | ||||
| CVE-2026-126640 | 1 Wordpress-extensions | 1 Wp Ultimate Csv Importer | 2026-11-14 | N/A |
| The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks. | ||||
| CVE-2026-96112 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 5.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96115 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-11-14 | 8 High |
| Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-96129 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-11-14 | 7.8 High |
| Inclusion of functionality from untrusted control sphere in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96134 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-96150 | 1 Microsoft | 24 Office, Windows 10 1607, Windows 10 1809 and 21 more | 2026-11-14 | 5.6 Medium |
| Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96158 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. | ||||