Export limit exceeded: 416053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416053 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126317 | 1 Frappe | 1 Hrms | 2026-11-13 | 8.8 High |
| Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency. | ||||
| CVE-2026-118741 | 1 Microsoft | 24 Microsoft.dotnet-scaffold, Microsoft.dotnet-scaffold-aspnet, Microsoft.dotnet-scaffold-aspnet Version 10.0.0-rc.1.25458.5 and 21 more | 2026-11-13 | 8.1 High |
| Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-121680 | 1 Microsoft | 24 Office, Windows 10 1607, Windows 10 1809 and 21 more | 2026-11-13 | 7.5 High |
| Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-119856 | 1 Microsoft | 17 Office, Office 365, Office Macos 2021 and 14 more | 2026-11-13 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-113549 | 3 Adobe, Apple, Microsoft | 3 Audition, Macos, Windows | 2026-11-13 | 5.5 Medium |
| Audition is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-113749 | 1 Microsoft | 24 Office, Windows 10 1607, Windows 10 1809 and 21 more | 2026-11-13 | 7.5 High |
| Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-95932 | 1 Microsoft | 16 Office, Office 365, Office Macos 2021 and 13 more | 2026-11-13 | 7.8 High |
| Inclusion of functionality from untrusted control sphere in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96144 | 1 Microsoft | 14 Office, Windows 10 1607, Windows 10 1809 and 11 more | 2026-11-13 | 4.7 Medium |
| Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96126 | 1 Microsoft | 14 Office, Windows 10 1607, Windows 10 1809 and 11 more | 2026-11-13 | 7.8 High |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95942 | 1 Microsoft | 17 Office, Office 365, Office Macos 2021 and 14 more | 2026-11-13 | 7.8 High |
| Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95922 | 1 Microsoft | 17 Office, Office 365, Office Macos 2021 and 14 more | 2026-11-13 | 7 High |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105544 | 1 Microsoft | 71 .net 10.0 Installed On Linux, .net 10.0 Installed On Mac Os, .net 10.0 Installed On Windows and 68 more | 2026-11-13 | 7.5 High |
| Improper access control in .NET allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-118711 | 1 Microsoft | 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more | 2026-11-13 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118710 | 1 Microsoft | 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more | 2026-11-13 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-126884 | 1 Google | 1 Chrome | 2026-11-13 | 4.7 Medium |
| Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-118709 | 1 Microsoft | 12 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 9 more | 2026-11-13 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-126398 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-11-13 | 5.9 Medium |
| vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients. | ||||
| CVE-2026-126397 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-11-13 | 7.5 High |
| vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face processor for Cohere2 Vision models without a server-side upper bound, causing quadratic CPU work during multimodal preprocessing. Remote clients can send small image chat-completion requests with large, varying max_patches values to bypass the LRU cache, exhaust preprocessing workers, and deny service to other clients. | ||||
| CVE-2026-112830 | 2 Brizy, Wordpress-extensions | 2 Brizy, Brizy | 2026-11-13 | 5.3 Medium |
| Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25. | ||||
| CVE-2026-127122 | 1 Rt-labs | 1 P-net | 2026-11-13 | N/A |
| P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected. | ||||