Export limit exceeded: 20633 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10682 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 390658 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (390658 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-58382 1 Thephpleague 1 Commonmark 2026-09-09 7.5 High
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
CVE-2022-51014 1 Pmmp 1 Pocketmine-mp 2026-09-09 6.5 Medium
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.
CVE-2026-81397 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 7.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-81398 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 7.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-81400 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 5.5 Medium
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-81948 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 7.8 High
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-17622 5 Apple, Ibm, Langflow and 2 more 5 Macos, Langflow Oss, Langflow and 2 more 2026-09-09 6.5 Medium
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
CVE-2026-81950 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 7.8 High
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-17627 5 Apple, Ibm, Langflow and 2 more 5 Macos, Langflow Oss, Langflow and 2 more 2026-09-09 4.9 Medium
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.
CVE-2026-81953 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 7.8 High
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-17631 5 Apple, Ibm, Langflow and 2 more 5 Macos, Langflow Oss, Langflow and 2 more 2026-09-09 5 Medium
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
CVE-2026-81954 1 Microsoft 11 365 Apps, Excel, Excel 2016 and 8 more 2026-09-09 7.8 High
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-19649 1 Ibm 3 App Connect Enterprise, Integration Bus For Z\/os, Integration Bus For Zos 2026-09-09 6.2 Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials.
CVE-2026-78543 1 Ibm 3 App Connect Enterprise, Integration Bus For Z\/os, Integration Bus For Zos 2026-09-09 5.3 Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.
CVE-2026-16180 1 Ibm 3 App Connect Enterprise, Integration Bus For Z\/os, Integration Bus For Zos 2026-09-09 5.7 Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.
CVE-2026-17273 1 Ibm 1 I 2026-09-09 6.5 Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.
CVE-2026-17274 1 Ibm 1 I 2026-09-09 5.4 Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.
CVE-2026-87737 2026-09-09 5.9 Medium
An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret.
CVE-2026-87732 2026-09-09 6.2 Medium
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext.
CVE-2026-86564 1 Redhat 2 Enterprise Linux, Openshift 2026-09-09 3.3 Low
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.