Export limit exceeded: 416200 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 416200 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 416200 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (416200 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-118300 1 Microsoft 13 365 Apps, Microsoft 365, Microsoft Office 365 For Mac and 10 more 2026-11-13 6.5 Medium
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-118299 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118298 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118297 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118296 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118295 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-126378 2 Givanz, Vvveb 2 Vvveb, Vvveb 2026-11-13 9.1 Critical
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.
CVE-2026-126377 2 Givanz, Vvveb 2 Vvveb, Vvveb 2026-11-13 8.1 High
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.
CVE-2026-126373 2 Givanz, Vvveb 2 Vvveb, Vvveb 2026-11-13 4.3 Medium
Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.
CVE-2026-126371 2 Givanz, Vvveb 2 Vvveb, Vvveb 2026-11-13 5.4 Medium
Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.
CVE-2026-126320 1 Finsys 1 Dockhand 2026-11-13 6.5 Medium
Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download endpoint, which reads through Docker's archive API, to retrieve secrets, keys, and mounted credentials.
CVE-2026-118294 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118293 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118292 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-116927 1 Microsoft 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more 2026-11-13 8.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-111292 1 Microsoft 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more 2026-11-13 6.5 Medium
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-126848 1 Google 1 Chrome 2026-11-13 3.1 Low
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126850 1 Google 2 Android, Chrome 2026-11-13 5.3 Medium
Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126853 1 Google 1 Chrome 2026-11-13 3.1 Low
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126854 1 Google 1 Chrome 2026-11-13 4.3 Medium
Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)