Export limit exceeded: 10258 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10258 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-108592 2026-10-14 5.3 Medium
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.
CVE-2026-107399 1 Sparklemotion 1 Mechanize 2026-10-14 6.8 Medium
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.
CVE-2026-102204 1 Microsoft 1 Defender For Endpoint 2026-10-14 7.8 High
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
CVE-2026-102202 1 Microsoft 7 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 4 more 2026-10-13 7.8 High
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-100214 1 Microsoft 2 Dynamics Nav 2017, Dynamics Nav 2018 2026-10-13 8.8 High
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
CVE-2026-96911 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-96225 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96231 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70264 1 Microsoft 1 Windows Defender 2026-10-13 5.5 Medium
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.
CVE-2026-88133 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83659 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83507 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 5.5 Medium
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.
CVE-2026-85900 1 Microsoft 1 Sharepoint Server 2026-10-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-70165 1 Microsoft 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 2026-10-13 6.7 Medium
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-88137 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 6.5 Medium
Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.
CVE-2026-69969 1 Microsoft 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more 2026-10-13 4.7 Medium
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
CVE-2026-85857 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 5.5 Medium
Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
CVE-2026-85849 1 Microsoft 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85840 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 6.5 Medium
Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
CVE-2026-85343 1 Microsoft 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more 2026-10-13 7.8 High
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.