Export limit exceeded: 409264 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409264 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-30971 | 2026-10-16 | 8.8 High | ||
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40. | ||||
| CVE-2026-85808 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.5 High |
| Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-85809 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 9.8 Critical |
| Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | ||||
| CVE-2026-108709 | 2026-10-16 | N/A | ||
| Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-96920 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-10-16 | 7.8 High |
| Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85810 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7 High |
| Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69080 | 2026-10-16 | N/A | ||
| Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-96921 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 5.5 Medium |
| Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96923 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7 High |
| Use after free in Windows Workstation Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96924 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 9.8 Critical |
| Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85811 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.5 High |
| Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-96925 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 5.5 Medium |
| Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96926 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-16 | 5.5 Medium |
| Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-96927 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-85812 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-16 | 5.5 Medium |
| Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96928 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 7.8 High |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102608 | 2026-10-16 | 9 Critical | ||
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3. | ||||
| CVE-2026-96929 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-16 | 7.8 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85814 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-85815 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | ||||