103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 8,501–8,550 of 103,766 · page 171 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-85815 | CVE-2026-85815 CVSS 5.5 | Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. |
| CVE-2026-85814 | CVE-2026-85814 CVSS 9.8 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85812 | CVE-2026-85812 CVSS 5.5 | Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally. |
| CVE-2026-85811 | CVE-2026-85811 CVSS 7.5 | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. |
| CVE-2026-85810 | CVE-2026-85810 CVSS 7.0 | Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-8581 | CVE-2026-8581 CVSS 8.8 | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
| CVE-2026-85809 | CVE-2026-85809 CVSS 9.8 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| CVE-2026-85808 | CVE-2026-85808 CVSS 7.5 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-85807 | CVE-2026-85807 CVSS 7.8 | Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85806 | CVE-2026-85806 CVSS 9.8 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85805 | CVE-2026-85805 CVSS 6.5 | Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-85804 | CVE-2026-85804 CVSS 7.8 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85803 | CVE-2026-85803 CVSS 7.0 | Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85802 | CVE-2026-85802 CVSS 7.0 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85800 | CVE-2026-85800 CVSS 7.8 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-8580 | CVE-2026-8580 CVSS 9.6 | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
| CVE-2026-85799 | CVE-2026-85799 CVSS 8.1 | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85798 | CVE-2026-85798 CVSS 7.2 | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. |
| CVE-2026-85797 | CVE-2026-85797 CVSS 6.5 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-85796 | CVE-2026-85796 CVSS 7.8 | Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85795 | CVE-2026-85795 CVSS 7.8 | Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85794 | CVE-2026-85794 CVSS 5.5 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally. |
| CVE-2026-85793 | CVE-2026-85793 CVSS 5.5 | Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information loc… |
| CVE-2026-85792 | CVE-2026-85792 CVSS 9.8 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| CVE-2026-85791 | CVE-2026-85791 CVSS 7.0 | Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85790 | CVE-2026-85790 CVSS 5.9 | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-85789 | CVE-2026-85789 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-85788 | CVE-2026-85788 CVSS 5.5 | Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass th… |
| CVE-2026-85787 | CVE-2026-85787 CVSS 6.5 | An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthentica… |
| CVE-2026-85786 | CVE-2026-85786 CVSS 7.5 | Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed… |
| CVE-2026-85781 | CVE-2026-85781 CVSS 8.7 | Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kuberne… |
| CVE-2026-8577 | CVE-2026-8577 CVSS 8.8 | Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
| CVE-2026-85769 | CVE-2026-85769 CVSS 6.5 | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on … |
| CVE-2026-85756 | CVE-2026-85756 CVSS 7.5 | SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the serv… |
| CVE-2026-85751 | CVE-2026-85751 CVSS 9.8 | Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH… |
| CVE-2026-85750 | CVE-2026-85750 CVSS 7.2 | Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficien… |
| CVE-2026-8575 | CVE-2026-8575 CVSS 8.3 | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
| CVE-2026-85747 | CVE-2026-85747 CVSS 6.8 | Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for… |
| CVE-2026-85740 | CVE-2026-85740 CVSS 7.1 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the lite… |
| CVE-2026-8574 | CVE-2026-8574 CVSS 8.3 | Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially pe… |
| CVE-2026-85738 | CVE-2026-85738 CVSS 6.3 | TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 tra… |
| CVE-2026-85734 | CVE-2026-85734 CVSS 9.1 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a… |
| CVE-2026-85733 | CVE-2026-85733 CVSS 5.3 | FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index… |
| CVE-2026-85732 | CVE-2026-85732 CVSS 4.7 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-… |
| CVE-2026-85731 | CVE-2026-85731 CVSS 8.8 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true ca… |
| CVE-2026-85730 | CVE-2026-85730 | smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline t… |
| CVE-2026-8573 | CVE-2026-8573 CVSS 8.3 | Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted … |
| CVE-2026-85725 | CVE-2026-85725 CVSS 5.9 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS… |
| CVE-2026-85724 | CVE-2026-85724 CVSS 9.6moquette | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes cl… |
| CVE-2026-85721 | CVE-2026-85721 CVSS 7.5 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |