Export limit exceeded: 413937 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413937 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413937 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107377 | 1 Datamodel-code-generator | 1 Datamodel-code-generator | 2026-10-14 | 7.5 High |
| datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0. | ||||
| CVE-2026-109732 | 1 Mozilla | 1 Firefox | 2026-10-14 | 5.4 Medium |
| Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109756 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | 8.8 High |
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-102866 | 1 Microsoft | 1 Sharepoint Server | 2026-10-14 | 8.1 High |
| Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69705 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-14 | 9.8 Critical |
| Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69650 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 11 24h2 and 9 more | 2026-10-14 | 7.8 High |
| Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108473 | 2026-10-14 | N/A | ||
| Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account information. Successful exploitation may allow an unauthenticated adjacent-network attacker to perform unauthorized device-management actions and disrupt legitimate user control. Under certain conditions, account-related information may also be exposed, potentially leading to compromise of the associated cloud account. | ||||
| CVE-2026-69633 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-14 | 7.8 High |
| Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69798 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 7.8 High |
| Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105726 | 1 Microsoft | 1 Defender For Endpoint | 2026-10-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-105731 | 1 Microsoft | 1 Office | 2026-10-13 | 5.5 Medium |
| Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-108464 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7 High |
| Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108133 | 1 Microsoft | 1 Windows Server 2022 | 2026-10-13 | 7.8 High |
| Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105729 | 1 Microsoft | 1 Windows Sysinternals Process Monitor | 2026-10-13 | 7.1 High |
| Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-109741 | 1 Mozilla | 1 Firefox | 2026-10-13 | 5.4 Medium |
| Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109751 | 1 Mozilla | 1 Firefox | 2026-10-13 | 4.3 Medium |
| Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109761 | 1 Mozilla | 1 Firefox | 2026-10-13 | 5.4 Medium |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-109765 | 1 Mozilla | 1 Firefox | 2026-10-13 | 4.2 Medium |
| Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109767 | 1 Mozilla | 1 Firefox | 2026-10-13 | 4.3 Medium |
| Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-102226 | 1 Microsoft | 1 Dynamics Nav 2018 | 2026-10-13 | 8.8 High |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network. | ||||