Export limit exceeded: 425877 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425877 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,877

Export CSV
CVE-2026-119936

Windows Internet Information Services Denial of Service Vulnerability

Integer underflow (wrap or wraparound) in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-40275

Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Blackberry
Products
Qnx Os For Medical Qnx Os For Safety Qnx Software Development Platform
CVE-2026-124739

Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf

A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Busybox Red Hat Redhat
Products
Busybox Enterprise Linux Enterprise Linux and 3 more
CVE-2026-84761

WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Server Side Request Forgery.This issue affects LiteSpeed Cache: from n/a through 7.9.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Litespeed Technologies Wordpress
Products
Litespeed Cache Wordpress
CVE-2026-129181

projectworlds Visitor Management System Login Endpoint user%20page.php mysqli_query sql injection

A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Projectworlds
Products
Visitor Management System
CVE-2026-121670

Windows Overlay Filter Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-54437

Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform

Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause data tampering in the memory input buffer of the Character I/O device driver.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Blackberry
Products
Qnx Software Development Platform
CVE-2026-18448

Leak SMM RAM from the kernel (Simply TSA after an SMI)

EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Tianocore
Products
Edk2
CVE-2026-54436

Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform

Heap-based Buffer Overflow in the io-char library's DCMD_CHR_WAITINFO devctl() handler could allow an attacker with local access to cause data tampering, arbitrary code execution, or a crash in the Character I/O device driver.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Blackberry
Products
Qnx Software Development Platform
CVE-2026-125333

Forge: ReDoS in forge.http response header and cookie trimming

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-14968

AMD MmSaveStateLib SysCall path performs out-of-bounds writes for partial save-state reads

EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Tianocore
Products
Edk2