Export limit exceeded: 395619 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395619 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395619 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19515 | 1 Wso2 | 1 Wso2 Integrator Mi For Visual Studio Code | 2026-09-15 | 7 High |
| The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution. | ||||
| CVE-2025-5802 | 2026-09-15 | 5.3 Medium | ||
| The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This behavior allows an attacker to discover valid usernames within the system. The discovery of valid usernames can facilitate subsequent attacks such as brute force, social engineering, and targeted phishing campaigns. | ||||
| CVE-2026-88819 | 2026-09-15 | N/A | ||
| In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. | ||||
| CVE-2026-70587 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.5 High |
| Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-71329 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 6.8 Medium |
| Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. | ||||
| CVE-2026-71337 | 1 Microsoft | 15 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 12 more | 2026-09-15 | 7.8 High |
| Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71338 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-09-15 | 6.4 Medium |
| Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71339 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 6.7 Medium |
| Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71340 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-09-15 | 7 High |
| Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71341 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 5.5 Medium |
| Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-71342 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-15 | 7 High |
| Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-71343 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.8 High |
| Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally. | ||||
| CVE-2026-71348 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 6.8 Medium |
| Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. | ||||
| CVE-2026-84445 | 1 Grpc | 1 Grpc-go | 2026-09-15 | 7.5 High |
| gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2. | ||||
| CVE-2026-87730 | 2026-09-15 | N/A | ||
| this is rejected | ||||
| CVE-2026-53659 | 2026-09-15 | 7.5 High | ||
| http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clients. The fix uses SizeLimitedInputStream to enforce a default 10 MiB limit, causes ServerFilters.GZip and RequestFilters.GunZip to return 413 Request Entity Too Large, and causes other decompression paths to throw SizeLimitExceededException. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.49.0.0. | ||||
| CVE-2026-16673 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-15 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property. | ||||
| CVE-2026-92002 | 1 Misp | 1 Misp | 2026-09-15 | N/A |
| Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Version affected: ≤2.5.45 | ||||
| CVE-2026-70290 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 5.5 Medium |
| Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-70289 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 7.8 High |
| Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | ||||