Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (417953 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-63694 1 Dell 1 Smartfabric Os10 2026-10-14 5 Medium
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-35160 1 Dell 2 Smartfabric Os10, Smartfabric Os10 Software 2026-10-14 5 Medium
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-74769 1 Dell 1 Powerprotect Data Manager 2026-10-14 6.5 Medium
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVE-2026-93748 1 Http-cache-semantics Project 1 Http-cache-semantics 2026-10-14 7.5 High
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
CVE-2026-93687 2 Jonschlinkert, Micromatch 2 Braces, Braces 2026-10-14 7.5 High
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.
CVE-2026-110202 1 Roocode 2 Roo-code, Roo Code 2026-10-14 8.8 High
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.
CVE-2026-110211 1 Iflytek 1 Skillhub 2026-10-14 8.1 High
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
CVE-2026-78457 1 Microsoft 9 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 6 more 2026-10-14 7 High
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
CVE-2026-78501 1 Microsoft 2 365 Copilot Business Chat, 365 Copilot Chat 2026-10-14 8.6 High
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
CVE-2026-55946 1 Microsoft 1 Copilot 2026-10-14 6.1 Medium
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-24303 1 Microsoft 1 Partner Center 2026-10-14 9.6 Critical
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-32078 1 Microsoft 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more 2026-10-14 7.8 High
Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-32225 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-10-14 8.8 High
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-32176 1 Microsoft 18 Microsoft Sql Server 2016 Service Pack 3 (gdr), Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft Sql Server 2017 (cu 31) and 15 more 2026-10-14 6.7 Medium
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-32074 1 Microsoft 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more 2026-10-14 7.8 High
Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-32070 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-10-14 7 High
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-32069 1 Microsoft 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more 2026-10-14 7.8 High
Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-105627 2026-10-14 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-106006 2026-10-14 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-106068 2026-10-14 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.