Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423702 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96973 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-11-10 | 7 High |
| Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96979 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 6.8 Medium |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-97000 | 1 Microsoft | 2 Windows 10 21h2, Windows 10 22h2 | 2026-11-10 | 7 High |
| Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96989 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 5.5 Medium |
| Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96982 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 6.8 Medium |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-96974 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 6.8 Medium |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. | ||||
| CVE-2026-96994 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7 High |
| Use after free in Winsock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-67375 | 1 Microsoft | 1 Sql Server 2025 | 2026-11-10 | 8.8 High |
| Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-68783 | 1 Microsoft | 2 Sql Server 2025, Sql Server 2025 For X64-based Systems Cu10 | 2026-11-10 | 6.5 Medium |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-67374 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-11-10 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-85929 | 1 Microsoft | 5 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 2 more | 2026-11-10 | 7.8 High |
| Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-81815 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 9.8 Critical |
| SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _ic=Y) with a crafted value, causing SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter, which is insufficient on MySQL/MariaDB because those dialects also honor backslash escapes, letting a backslash-terminated payload break out of the string literal and turn the WHERE clause into a tautology. The default Derby datasource and PostgreSQL are not affected because they do not interpret backslash as an escape character in this context. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-81808 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 6.5 Medium |
| Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product search and then invoking search-result mutation events such as searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, and searchRemoveFeature, causing the servlet to authorize the request against only the base view-level permission declared on the request-map while the underlying event methods perform bulk entity-engine deletes/inserts without checking the DELETE/CREATE permission enforced by the equivalent service-layer operations (e.g. removeProductFromCategory). Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-96175 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-11-10 | 7.8 High |
| Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96172 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-11-10 | 7.8 High |
| No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96168 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7 High |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96162 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7.8 High |
| Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96160 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7.8 High |
| Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96157 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96156 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally. | ||||