Export limit exceeded: 416065 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 416065 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 29135 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29135 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-105798 1 Microsoft 1 Simplechat 2026-10-07 8.7 High
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029.
CVE-2026-70341 3 Apple, Linux, Microsoft 5 Macos, Linux Kernel, Edge and 2 more 2026-10-06 8.5 High
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-70125 1 Microsoft 3 365 Apps, Office 2021, Office 2024 2026-10-05 8.8 High
Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-57099 1 Microsoft 3 .asp.netcore, .asp.netcore, Asp.net Core Odata 2026-10-05 7.5 High
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-55007 1 Microsoft 7 Exchange Server, Exchange Server 2019, Exchange Server Se and 4 more 2026-10-05 8.1 High
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVE-2026-103624 2 Google, Microsoft 2 Chrome, Windows 2026-10-05 8.3 High
Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-103626 2 Google, Microsoft 2 Chrome, Windows 2026-10-05 9.6 Critical
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-69562 1 Microsoft 2 Sql Server 2017, Sql Server 2019 2026-10-02 6.5 Medium
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2026-67630 1 Microsoft 4 Sql Server 2017, Sql Server 2019, Sql Server 2022 and 1 more 2026-10-02 6.5 Medium
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67629 1 Microsoft 8 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr) and 5 more 2026-10-02 6.5 Medium
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-95385 2 Google, Microsoft 2 Chrome, Windows 2026-10-02 6.5 Medium
Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2021-27065 1 Microsoft 1 Exchange Server 2026-10-01 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 1 Microsoft 1 Exchange Server 2026-10-01 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26411 1 Microsoft 17 Edge, Internet Explorer, Windows 10 1507 and 14 more 2026-10-01 8.8 High
Internet Explorer Memory Corruption Vulnerability
CVE-2021-20023 2 Microsoft, Sonicwall 20 Windows, Email Security, Email Security Appliance 3300 and 17 more 2026-10-01 4.9 Medium
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVE-2021-20022 2 Microsoft, Sonicwall 20 Windows, Email Security, Email Security Appliance 3300 and 17 more 2026-10-01 7.2 High
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
CVE-2018-15982 6 Adobe, Apple, Google and 3 more 12 Flash Player, Flash Player Installer, Mac Os X and 9 more 2026-10-01 7.8 High
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2020-0796 1 Microsoft 4 Windows 10 1903, Windows 10 1909, Windows Server 1903 and 1 more 2026-10-01 10 Critical
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVE-2022-50696 3 Linux, Microsoft, Sound4 23 Linux, Windows, Big Voice2 and 20 more 2026-10-01 9.8 Critical
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.
CVE-2015-2291 2 Intel, Microsoft 3 Ethernet Diagnostics Driver Iqvw32.sys, Ethernet Diagnostics Driver Iqvw64.sys, Windows 2026-10-01 7.8 High
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.