Export limit exceeded: 37218 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 37218 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 37218 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 37218 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ',' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37218 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-48575 1 Google 1 Android 2026-02-26 7.8 High
In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-60720 1 Microsoft 27 Windows, Windows 10, Windows 10 1607 and 24 more 2026-02-26 7.8 High
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.
CVE-2025-48580 1 Google 1 Android 2026-02-26 7.8 High
In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-48583 1 Google 1 Android 2026-02-26 7.8 High
In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62200 1 Microsoft 10 365, 365 Apps, Excel and 7 more 2026-02-26 7.8 High
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-48586 1 Google 1 Android 2026-02-26 7.8 High
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62201 1 Microsoft 14 365, 365 Apps, Excel and 11 more 2026-02-26 7.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-48588 1 Google 1 Android 2026-02-26 7.8 High
In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62203 1 Microsoft 13 365, 365 Apps, Excel and 10 more 2026-02-26 7.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-48589 1 Google 1 Android 2026-02-26 7.8 High
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62204 1 Microsoft 5 Office Sharepoint Server, Sharepoint Enterprise Server 2016, Sharepoint Server and 2 more 2026-02-26 8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-48594 1 Google 1 Android 2026-02-26 7.8 High
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2025-62205 1 Microsoft 7 365, 365 Apps, Office 2021 and 4 more 2026-02-26 7.8 High
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-48596 1 Google 1 Android 2026-02-26 7.8 High
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-59499 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2026-02-26 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-48597 1 Google 1 Android 2026-02-26 7.8 High
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62211 1 Microsoft 2 365, Dynamics 365 2026-02-26 8.7 High
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
CVE-2025-48599 1 Google 1 Android 2026-02-26 7.8 High
In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-62214 1 Microsoft 2 Visual Studio, Visual Studio 2022 2026-02-26 6.7 Medium
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.
CVE-2025-62215 1 Microsoft 19 Windows 10, Windows 10 1809, Windows 10 21h2 and 16 more 2026-02-26 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.