Export limit exceeded: 108594 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (108594 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85886 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-11-02 | 8.5 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-94512 | 1 Microsoft | 12 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 (gdr) and 9 more | 2026-11-02 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-96956 | 1 Microsoft | 8 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more | 2026-11-02 | 8 High |
| Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-68883 | 1 Microsoft | 13 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 (gdr) and 10 more | 2026-11-02 | 8.5 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-20565 | 2 Mediatek, Mediatek, Inc. | 2 Mediatek Chipset, Mediatek Chipset | 2026-11-02 | 8.4 High |
| In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778991; Issue ID: MSV-8900. | ||||
| CVE-2026-20591 | 2 Mediatek, Mediatek, Inc. | 2 Mediatek Chipset, Mediatek Chipset | 2026-11-02 | 8.4 High |
| In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546. | ||||
| CVE-2026-112659 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-02 | 8.8 High |
| A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-117617 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.1 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system. | ||||
| CVE-2026-117618 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.1 High |
| In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced. | ||||
| CVE-2026-117619 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.1 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires. | ||||
| CVE-2026-117620 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-11-02 | 8.8 High |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords. | ||||
| CVE-2026-112677 | 1 Apple | 1 Macos | 2026-11-02 | 7.8 High |
| An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be able to execute arbitrary code with system privileges. | ||||
| CVE-2026-112623 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-02 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-112626 | 1 Apple | 8 Ios And Ipados, Ipados, Iphone Os and 5 more | 2026-11-02 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-112637 | 1 Apple | 8 Ios And Ipados, Ipados, Iphone Os and 5 more | 2026-11-02 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-112651 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-11-02 | 8.8 High |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution. | ||||
| CVE-2026-64759 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-11-02 | 8.8 High |
| An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution. | ||||
| CVE-2026-120460 | 1 Dromara | 1 Jpom | 2026-11-02 | 8.8 High |
| Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts. | ||||
| CVE-2026-120448 | 1 Doramart | 1 Doracms | 2026-11-02 | 8.1 High |
| DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content. | ||||
| CVE-2026-120348 | 2 Dayrui, Xunruicms | 2 Xunruicms, Xunruicms | 2026-11-02 | 7.3 High |
| A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||