Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 326–350 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96865 | MEDIUM | 5.6 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. | |
| CVE-2026-96863 | MEDIUM | 6.8 | 2026-10-13 | Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | |
| CVE-2026-96860 | MEDIUM | 5.5 | 2026-10-13 | Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally. | |
| CVE-2026-96859 | MEDIUM | 5.5 | 2026-10-13 | Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-96858 | MEDIUM | 5.5 | 2026-10-13 | Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally. | |
| CVE-2026-96857 | MEDIUM | Patched | 5.5 | 2026-10-13 | Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally. |
| CVE-2026-96855 | MEDIUM | Patched | 5.5 | 2026-10-13 | Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. |
| CVE-2026-96854 | MEDIUM | Patched | 5.5 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally. |
| CVE-2026-96853 | MEDIUM | Patched | 4.7 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| CVE-2026-96851 | MEDIUM | Patched | 5.5 | 2026-10-13 | Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
| CVE-2026-96850 | MEDIUM | Patched | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. |
| CVE-2026-96849 | MEDIUM | Patched | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
| CVE-2026-96848 | MEDIUM | Patched | 5.5 | 2026-10-13 | Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| CVE-2026-96846 | MEDIUM | Patched | 5.5 | 2026-10-13 | Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally. |
| CVE-2026-96835 | MEDIUM | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions. | |
| CVE-2026-96834 | MEDIUM | 6.5 | 2026-09-30 | Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. | |
| CVE-2026-96829 | MEDIUM | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions. | |
| CVE-2026-96825 | MEDIUM | 4.2 | 2026-09-30 | Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions. | |
| CVE-2026-96824 | MEDIUM | 6.8 | 2026-09-30 | Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. | |
| CVE-2026-96821 | MEDIUM | 6.3 | 2026-09-30 | Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. | |
| CVE-2026-96807 | MEDIUM | Patched | 4.0 | 2026-09-23 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location… |
| CVE-2026-96806 | MEDIUM | Patched | 5.8 | 2026-10-15 | The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unr… |
| CVE-2026-9680 | MEDIUM | 5.8 | 2026-07-28 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listeni… | |
| CVE-2026-9679 | MEDIUM | Patched | 5.9 | 2026-06-17 | Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal b… |
| CVE-2026-9678 | MEDIUM | Patched | 5.9 | 2026-06-17 | Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-… |