Export limit exceeded: 413603 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413603 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111308 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-12 | 8.8 High |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-116928 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 9.8 Critical |
| Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-116714 | 1 Microsoft | 7 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 4 more | 2026-11-12 | 7.8 High |
| Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-56966 | 2026-11-12 | N/A | ||
| In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56969 | 2026-11-12 | N/A | ||
| In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-56971 | 2026-11-12 | N/A | ||
| In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56995 | 2026-11-12 | N/A | ||
| In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-57004 | 2026-11-12 | N/A | ||
| In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-116722 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-12 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-116927 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-116929 | 1 Microsoft | 9 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more | 2026-11-12 | 7.5 High |
| Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-116931 | 1 Microsoft | 9 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more | 2026-11-12 | 7.5 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-116932 | 1 Microsoft | 9 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more | 2026-11-12 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-113517 | 1 Adobe | 1 After Effects | 2026-11-12 | 7.8 High |
| After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-116480 | 1 Adobe | 1 Photoshop | 2026-11-12 | 7.8 High |
| Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-109832 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Eus | 2026-11-12 | 7.5 High |
| A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service. | ||||
| CVE-2026-126132 | 2026-11-12 | 7.5 High | ||
| When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider. This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. | ||||
| CVE-2026-126134 | 2026-11-12 | 6.1 Medium | ||
| Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. | ||||
| CVE-2026-126135 | 2026-11-12 | 6.1 Medium | ||
| If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. | ||||
| CVE-2026-113815 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 4.7 Medium |
| Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature locally. | ||||