Export limit exceeded: 18286 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 80726 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 350927 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (350927 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-34336 1 Microsoft 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more 2026-05-14 7.8 High
Buffer over-read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
CVE-2026-44009 2 Patriksimek, Vm2 Project 2 Vm2, Vm2 2026-05-14 9.8 Critical
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.
CVE-2026-34337 1 Microsoft 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more 2026-05-14 7.8 High
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-38360 1 Fohrloop 1 Dash-uploader 2026-05-14 9.8 Critical
Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, aseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components
CVE-2026-34338 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 7.8 High
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVE-2026-34339 1 Microsoft 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more 2026-05-14 5.5 Medium
Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.
CVE-2026-34340 1 Microsoft 22 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 19 more 2026-05-14 7 High
Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-44854 2 Arubanetworks, Hpe 3 Arubaos, Sd-wan, Arubaos 2026-05-14 7.2 High
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
CVE-2026-44853 2 Arubanetworks, Hpe 3 Arubaos, Sd-wan, Arubaos 2026-05-14 7.2 High
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
CVE-2026-34341 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 7 High
Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.
CVE-2026-1340 1 Ivanti 1 Endpoint Manager Mobile 2026-05-14 9.8 Critical
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-34342 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVE-2026-34343 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 7.8 High
Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.
CVE-2025-65086 2 Ashlar, Ashlar Vellum 10 Argon, Cobalt, Cobalt Share and 7 more 2026-05-14 7.8 High
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to execute arbitrary code when a specially crafted VC6 file is being parsed.
CVE-2025-65087 2 Ashlar, Ashlar Vellum 10 Argon, Cobalt, Cobalt Share and 7 more 2026-05-14 7.8 High
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
CVE-2025-65088 2 Ashlar, Ashlar Vellum 10 Argon, Cobalt, Cobalt Share and 7 more 2026-05-14 7.8 High
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
CVE-2026-44224 1 Requarks 1 Wiki.js 2026-05-14 8.8 High
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can be assigned. A user with manage:users — a permission typically delegated to wiki moderators for account management — can set groups:[1] on their own account to self-assign to the Administrators group. After re-authentication, the fresh JWT carries manage:system, granting full site administrator access in a single mutation call. This vulnerability is fixed in 2.5.313.
CVE-2026-21530 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 6.7 Medium
Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.
CVE-2026-32161 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 7.5 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-32170 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 6.7 Medium
Double free in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.