Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425880 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119385 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 4.7 Medium |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to deny service locally. | ||||
| CVE-2026-79914 | 1 Nocobase | 1 Nocobase | 2026-11-14 | 4.3 Medium |
| NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored request URL at runtime using options.url, causing the NocoBase server to send requests to attacker-controlled or internal destinations. Exploitation could expose internal services, Docker host gateways, or cloud metadata endpoints and allow the server to be used as a trusted network proxy. This issue has been fixed in version 2.1.15. | ||||
| CVE-2026-96133 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96137 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-11-14 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-95932 | 1 Microsoft | 27 Microsoft Office Ltsc For Mac 2021, Microsoft Office Ltsc For Mac 2024, Office and 24 more | 2026-11-14 | 7.8 High |
| Inclusion of functionality from untrusted control sphere in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95962 | 1 Microsoft | 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more | 2026-11-14 | 9 Critical |
| Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-95983 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-14 | 7.8 High |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96061 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105582 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-11-14 | 7 High |
| Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108409 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-129447 | 1 Yuzutech | 1 Kroki | 2026-11-14 | 6.1 Medium |
| Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin. | ||||
| CVE-2026-129137 | 1 Devolutions | 1 Powershell Universal | 2026-11-14 | N/A |
| Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server. | ||||
| CVE-2026-84005 | 1 Microsoft | 16 Windows 10 1809, Windows 11 23h2, Windows 11 23h2 and 13 more | 2026-11-14 | 5.5 Medium |
| Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-84004 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-14 | 5.5 Medium |
| Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83684 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-14 | 7.5 High |
| Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-96176 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-11-14 | 7.5 High |
| Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-112762 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 8.8 High |
| Relative path traversal in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-112797 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-14 | 7 High |
| Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-123395 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-14 | 5.9 Medium |
| Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-54831 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-11-14 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Blind SQL Injection.This issue affects GeoDirectory: from n/a through 2.8.162. | ||||