Browse All CVEs
12,214 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-77482 |
high | 8.8 | 0.0082 | 2026-10-29 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code o | |
CVE-2026-70178 |
high | 8.5 | 0.0063 | 2026-10-29 | Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privile | |
CVE-2026-69857 |
high | 8.5 | 0.0063 | 2026-10-29 | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized a | |
CVE-2026-69782 |
high | 8.1 | 0.0054 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-69522 |
high | 8.8 | 0.0084 | 2026-10-29 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute cod | |
CVE-2026-68791 |
high | 8.6 | 0.0054 | 2026-10-29 | Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to discl | |
CVE-2026-69341 |
high | 7.0 | 0.0026 | 2026-10-29 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privi | |
CVE-2026-66304 |
high | 7.5 | 0.0097 | 2026-10-29 | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker t | |
CVE-2026-65818 |
high | 8.5 | 0.0063 | 2026-10-29 | Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elev | |
CVE-2026-62744 |
high | 8.8 | 0.0082 | 2026-10-29 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized at | |
CVE-2026-62895 |
high | 8.8 | 0.0080 | 2026-10-29 | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized | |
CVE-2026-62694 |
high | 7.0 | 0.0026 | 2026-10-29 | Use after free in Windows Installer allows an authorized attacker to elevate privileges lo | |
CVE-2026-62706 |
high | 8.8 | 0.0082 | 2026-10-29 | Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker t | |
CVE-2026-57098 |
high | 7.5 | 0.0064 | 2026-10-29 | Improper verification of cryptographic signature in Windows RDP Client allows an unauthori | |
CVE-2026-67373 |
high | 8.8 | 0.0091 | 2026-10-29 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code ove | |
CVE-2026-67368 |
high | 8.8 | 0.0102 | 2026-10-29 | Improper link resolution before file access ('link following') in SQL Server allows an aut | |
CVE-2026-67370 |
high | 8.8 | 0.0099 | 2026-10-29 | Improper neutralization of special elements used in an sql command ('sql injection') in SQ | |
CVE-2026-50349 |
high | 7.0 | 0.0020 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2019-25776 |
high | 8.7 | 0.0060 | 2026-10-29 | Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote | |
CVE-2019-25733 |
high | 8.6 | 0.0015 | 2026-10-29 | NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerabil | |
CVE-2019-25765 |
high | 8.7 | 0.0074 | 2026-10-29 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows | |
CVE-2019-25705 |
high | 8.6 | 0.0025 | 2026-10-29 | Echo Mirage 3.1 contains a stack buffer overflow vulnerability that allows local attackers | |
CVE-2019-25654 |
high | 8.7 | 0.0070 | 2026-10-29 | Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to | |
CVE-2019-25269 |
high | 8.5 | 0.0037 | 2026-10-29 | Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows se | |
CVE-2019-25276 |
high | 8.5 | 0.0021 | 2026-10-29 | Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the | |
CVE-2017-20284 |
high | 8.7 | 0.0117 | 2026-10-29 | Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-do | |
CVE-2017-20252 |
high | 8.8 | 0.0048 | 2026-10-29 | Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenti | |
CVE-2016-20058 |
high | 8.5 | 0.0072 | 2026-10-29 | Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in | |
CVE-2016-20097 |
high | 8.7 | 0.0063 | 2026-10-29 | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLo | |
CVE-2015-20120 |
high | 8.8 | 0.0042 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains multiple time-based blind SQL injection vu | |
CVE-2016-20057 |
high | 8.5 | 0.0061 | 2026-10-29 | NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in | |
CVE-2026-104084 |
high | 8.7 | 0.0031 | 2026-10-29 | SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT acce | |
CVE-2026-104082 |
high | 8.6 | 0.0087 | 2026-10-29 | SmarterMail before build 9777 contains a remote code execution vulnerability that allows a | |
CVE-2026-104077 |
high | 8.5 | 0.0026 | 2026-10-29 | Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows | |
CVE-2026-104078 |
high | 8.4 | 0.0017 | 2026-10-29 | Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJ | |
CVE-2026-104069 |
high | 8.6 | 0.0053 | 2026-10-29 | HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startI | |
CVE-2026-100640 |
high | 8.6 | 0.0024 | 2026-10-29 | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that | |
CVE-2026-0993 |
high | 8.7 | 0.0039 | 2026-10-29 | SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability | |
CVE-2026-100635 |
high | 8.2 | 0.0033 | 2026-10-29 | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish servic | |
CVE-2023-54402 |
high | 8.7 | 0.0045 | 2026-10-29 | iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint | |
CVE-2022-50926 |
high | 8.7 | 0.0055 | 2026-10-29 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability tha | |
CVE-2021-47802 |
high | 8.7 | 0.0070 | 2026-10-29 | Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerabilit | |
CVE-2026-88893 |
high | 8.7 | 0.0049 | 2026-10-29 | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and retur | |
CVE-2026-88891 |
high | 7.2 | 0.0044 | 2026-10-29 | OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutati | |
CVE-2026-88890 |
high | 8.4 | 0.0039 | 2026-10-29 | OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter bu | |
CVE-2026-85612 |
high | 8.7 | 0.0041 | 2026-10-29 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerabili | |
CVE-2026-85613 |
high | 8.4 | 0.0040 | 2026-10-29 | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticate | |
CVE-2026-85610 |
high | 8.7 | 0.0071 | 2026-10-29 | OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing auth | |
CVE-2026-82634 |
high | 7.1 | 0.0042 | 2026-10-29 | Frappe Framework development builds contain an authorization flaw in the render_jinja_temp | |
CVE-2026-77214 |
high | 8.3 | 0.0032 | 2026-10-29 | libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse. |