Export limit exceeded: 108102 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (108102 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-36049 | 2 Microsoft, Redhat | 19 .net, .net Framework, Visual Studio and 16 more | 2026-11-02 | 7.6 High |
| .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability | ||||
| CVE-2023-32558 | 1 Nodejs | 1 Node.js | 2026-11-02 | 7.5 High |
| The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. | ||||
| CVE-2023-29007 | 3 Fedoraproject, Git-scm, Redhat | 7 Fedora, Git, Enterprise Linux and 4 more | 2026-11-02 | 7 High |
| Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. | ||||
| CVE-2023-23384 | 1 Microsoft | 1 Sql Server | 2026-11-02 | 7.3 High |
| Microsoft SQL Server Remote Code Execution Vulnerability | ||||
| CVE-2023-21713 | 1 Microsoft | 1 Sql Server | 2026-11-02 | 8.8 High |
| Microsoft SQL Server Remote Code Execution Vulnerability | ||||
| CVE-2023-21705 | 1 Microsoft | 1 Sql Server | 2026-11-02 | 8.8 High |
| Microsoft SQL Server Remote Code Execution Vulnerability | ||||
| CVE-2023-21704 | 1 Microsoft | 1 Sql Server | 2026-11-02 | 7.8 High |
| Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | ||||
| CVE-2023-21568 | 1 Microsoft | 3 Sql Server, Sql Server 2019 Integration Services, Sql Server 2022 Integration Services | 2026-11-02 | 7.3 High |
| Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability | ||||
| CVE-2023-21528 | 1 Microsoft | 1 Sql Server | 2026-11-02 | 7.8 High |
| Microsoft SQL Server Remote Code Execution Vulnerability | ||||
| CVE-2023-1077 | 4 Debian, Linux, Netapp and 1 more | 23 Debian Linux, Linux Kernel, 8300 and 20 more | 2026-11-02 | 7.0 High |
| In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. | ||||
| CVE-2022-48560 | 3 Debian, Python, Redhat | 4 Debian Linux, Python, Enterprise Linux and 1 more | 2026-11-02 | 7.5 High |
| A use-after-free exists in Python through 3.9 via heappushpop in heapq. | ||||
| CVE-2022-41083 | 1 Microsoft | 1 Jupyter | 2026-11-02 | 7.8 High |
| Visual Studio Code Elevation of Privilege Vulnerability | ||||
| CVE-2022-41042 | 1 Microsoft | 1 Visual Studio Code | 2026-11-02 | 7.4 High |
| Visual Studio Code Information Disclosure Vulnerability | ||||
| CVE-2022-34717 | 1 Microsoft | 3 365 Apps, Office, Office Long Term Servicing Channel | 2026-11-02 | 8.8 High |
| Microsoft Office Remote Code Execution Vulnerability | ||||
| CVE-2026-28588 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55257 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55271 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55287 | 1 Google | 1 Android | 2026-11-02 | 8.4 High |
| In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-40176 | 1 Getcomposer | 1 Composer | 2026-11-02 | 7.8 High |
| Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). | ||||
| CVE-2026-91898 | 1 Dell | 1 Alienware Command Center | 2026-11-02 | 8.1 High |
| Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Elevation of Privilege. | ||||