Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96938 | MEDIUM | Patched | 6.7 | 2026-10-13 | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96935 | MEDIUM | Patched | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally. |
| CVE-2026-96930 | MEDIUM | Patched | 5.5 | 2026-10-13 | Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. |
| CVE-2026-96927 | MEDIUM | Patched | 5.5 | 2026-10-13 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
| CVE-2026-96926 | MEDIUM | Patched | 5.5 | 2026-10-13 | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. |
| CVE-2026-96925 | MEDIUM | Patched | 5.5 | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized attacker to disclose information locally. |
| CVE-2026-96921 | MEDIUM | Patched | 5.5 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally. |
| CVE-2026-9692 | MEDIUM | 5.3 | 2026-06-18 | Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built… | |
| CVE-2026-96910 | MEDIUM | 5.5 | 2026-10-13 | Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-96904 | MEDIUM | Patched | 5.3 | 2026-10-14 | The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthen… |
| CVE-2026-96903 | MEDIUM | Patched | 4.3 | 2026-10-20 | The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authent… |
| CVE-2026-96902 | MEDIUM | Patched | 5.3 | 2026-10-20 | The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to re… |
| CVE-2026-96900 | MEDIUM | Patched | 5.3 | 2026-10-14 | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before d… |
| CVE-2026-96899 | MEDIUM | Patched | 6.8 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing i… |
| CVE-2026-96897 | MEDIUM | Patched | 5.3 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing una… |
| CVE-2026-96895 | MEDIUM | Patched | 6.8 | 2026-09-27 | The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the bl… |
| CVE-2026-96892 | MEDIUM | 4.3 | 2026-09-24 | A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument … | |
| CVE-2026-9689 | MEDIUM | 4.2 | 2026-05-27 | A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Iden… | |
| CVE-2026-96886 | MEDIUM | Patched | 5.3 | 2026-09-30 | The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address a… |
| CVE-2026-96884 | MEDIUM | 6.3 | 2026-09-24 | A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The… | |
| CVE-2026-96882 | MEDIUM | 5.3 | 2026-09-24 | A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/tal… | |
| CVE-2026-96881 | MEDIUM | 5.3 | 2026-09-24 | A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/… | |
| CVE-2026-96880 | MEDIUM | 5.3 | 2026-09-24 | A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/Bo… | |
| CVE-2026-96870 | MEDIUM | 6.4 | 2026-10-16 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up t… | |
| CVE-2026-96869 | MEDIUM | Patched | 4.3 | 2026-09-29 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, … |