Export limit exceeded: 26203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10242 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424751 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-106137 | 2026-11-11 | 8.6 High | ||
| In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`. | ||||
| CVE-2026-62971 | 2026-11-11 | 7.2 High | ||
| The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0. | ||||
| CVE-2026-86364 | 2026-11-11 | 4.7 Medium | ||
| Dell Live Optics Collector, versions prior to 27.3.8.317 contains a Use of Insufficiently Random Values vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. | ||||
| CVE-2026-106156 | 2026-11-11 | 8.6 High | ||
| In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`. | ||||
| CVE-2026-119855 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-11 | 5.5 Medium |
| Buffer over-read in Windows COM+ Event System Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-123384 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123379 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123378 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 7.5 High |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123377 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123376 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-123375 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120791 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120790 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120789 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120788 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120786 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120785 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120005 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119986 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-11 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119982 | 1 Microsoft | 1 Visual Studio Code | 2026-11-11 | 6.5 Medium |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||||