Export limit exceeded: 10821 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,821

Export CSV
CVE-2026-120000

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2024-6794

Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server

A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Ni
Products
Veristand
CVE-2024-6793

Deserialization of Untrusted Data in NI VeriStand DataLogging Server

A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Ni
Products
Veristand
CVE-2024-6675

Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File

A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ni
Products
Veristand
CVE-2026-74853

Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pods
CVE-2026-71395

Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading

unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110044

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-108470

Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Msal-node
CVE-2026-64858

vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler

vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109464

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-109472

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-124229

Microsoft Office Excel Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.

CVSS 3.1 · 6.6 Medium EPSS 1.9% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024 and 3 more
CVE-2026-19093

Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Tutor Lms
CVE-2026-14558

WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp User Frontend