Export limit exceeded: 377227 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 377227 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 92734 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (92734 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-50387 1 Microsoft 26 365 Copilot, Microsoft 365, Office and 23 more 2026-07-15 7.8 High
Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
CVE-2026-50321 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-07-15 7.8 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-50425 1 Microsoft 11 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 8 more 2026-07-15 7.8 High
Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.
CVE-2026-50463 1 Microsoft 14 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 11 more 2026-07-15 7.5 High
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.
CVE-2026-50344 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-07-15 7.8 High
Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.
CVE-2026-50406 1 Microsoft 10 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 7 more 2026-07-15 7 High
Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
CVE-2026-50470 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-07-15 7.5 High
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
CVE-2026-50502 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-07-15 8 High
Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network.
CVE-2026-50496 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-07-15 7.5 High
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
CVE-2026-50680 1 Microsoft 14 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 11 more 2026-07-15 8.2 High
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-50686 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-07-15 8.1 High
Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.
CVE-2026-50665 1 Microsoft 9 365 Apps, Microsoft 365, Office 2016 and 6 more 2026-07-15 7.8 High
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-56642 2 Fabric, Microsoft 3 Data Warehouse, Fabric Data Warehouse, Service Fabric 2026-07-15 8.8 High
Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.
CVE-2026-50663 1 Microsoft 2 Age Of Empires Ii, Age Of Empires Ii 2026-07-15 8.8 High
Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.
CVE-2026-56398 1 Openwebui 1 Open Webui 2026-07-15 7.3 High
Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.
CVE-2026-61433 1 Praison 1 Praisonai 2026-07-15 7.8 High
PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.
CVE-2026-61446 1 Praison 1 Praisonai 2026-07-15 8.4 High
PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.
CVE-2026-48365 3 Adobe, Apple, Microsoft 3 Audition, Macos, Windows 2026-07-15 7.8 High
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-47967 3 Adobe, Apple, Microsoft 3 Audition, Macos, Windows 2026-07-15 7.8 High
Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-60085 1 Praison 1 Praisonai 2026-07-15 7.5 High
PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.