Export limit exceeded: 10569 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10569 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-117871 1 Mozilla 1 Firefox 2026-10-27 N/A
Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117914 1 Mozilla 1 Firefox 2026-10-27 N/A
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117935 1 Mozilla 1 Firefox 2026-10-27 N/A
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117875 1 Mozilla 1 Firefox 2026-10-27 N/A
Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117880 1 Mozilla 1 Firefox 2026-10-27 N/A
Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-113869 1 Mozilla 1 Thunderbird 2026-10-27 5.4 Medium
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.
CVE-2026-103575 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-27 8.8 High
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-108333 2026-10-27 2.5 Low
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
CVE-2026-87694 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-27 7.8 High
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-105006 1 Microsoft 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more 2026-10-27 6.4 Medium
Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-108458 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-10-27 8.8 High
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-108464 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-27 7 High
Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
CVE-2026-69986 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-27 7.5 High
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-69987 1 Microsoft 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more 2026-10-27 7.5 High
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-109707 1 Mozilla 1 Firefox 2026-10-27 9.6 Critical
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
CVE-2026-109705 1 Mozilla 1 Firefox 2026-10-27 9.6 Critical
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
CVE-2026-109619 4 Paloaltonetworks, Php, Redhat and 1 more 14 Pan-os, Panorama M-200, Panorama M-300 and 11 more 2026-10-27 8.1 High
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVE-2026-109618 4 Paloaltonetworks, Php, Redhat and 1 more 14 Pan-os, Panorama M-200, Panorama M-300 and 11 more 2026-10-27 9.8 Critical
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CVE-2026-63927 1 Linux 1 Linux Kernel 2026-10-27 7.8 High
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time.
CVE-2026-63922 1 Linux 1 Linux Kernel 2026-10-27 9.8 Critical
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.