Export limit exceeded: 376996 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 376996 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376996 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-21273 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 8.7 High |
| is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-62753 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 7 High |
| Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-73643 | 2026-08-13 | 7.5 High | ||
| js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2. | ||||
| CVE-2026-12908 | 2026-08-13 | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||
| CVE-2026-62811 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-73569 | 2026-08-13 | N/A | ||
| fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1. | ||||
| CVE-2026-14256 | 1 Lenovo | 262 100w Gen 4 Laptop Lenovo Elan Trackpoint Driver For Windows 11 Version 22h2 Or Later - Lenovo 100w Gen 4 300w Yoga Gen 4 500w Yoga Gen 4, 100w Gen 5 Type 83ld 83le Laptop Lenovo Elan Trackpoint Driver For Windows 11 Version 23h2 Or Later - Lenovo 100w Gen 5 300w 2-in-1 Gen 5 500w 2-in-1 Gen 5, 11e Yoga Gen 6 Type 20se 20sf Laptop Thinkpad Elan Clickpad Driver For Windows 11 Version 21h2 Or Later 10 Version 1809 Or Later - Thinkpad Yoga 11e 6th Gen and 259 more | 2026-08-13 | 4.7 Medium |
| ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash. | ||||
| CVE-2026-73559 | 1 Vllm-project | 1 Vllm | 2026-08-13 | 6.5 Medium |
| vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0. | ||||
| CVE-2026-73568 | 2026-08-13 | 7.5 High | ||
| py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame declaring a 0xFFFFFFFF body and then withhold the body, causing the sequential yamux read loop used by the default new_host() configuration to block and preventing every stream on that connection from making progress. No fixed version is available as of this review. | ||||
| CVE-2026-62800 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 8.8 High |
| Heap-based buffer overflow in Windows SMB Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-73566 | 2026-08-13 | 7.5 High | ||
| node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21. | ||||
| CVE-2026-21279 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 8.2 High |
| is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-73565 | 2026-08-13 | 5.3 Medium | ||
| @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10. | ||||
| CVE-2026-65781 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 1 more | 2026-08-13 | 7 High |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65782 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 1 more | 2026-08-13 | 7 High |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65778 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 1 more | 2026-08-13 | 7 High |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65780 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-08-13 | 7 High |
| Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65779 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-08-13 | 7 High |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62788 | 1 Microsoft | 9 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 6 more | 2026-08-13 | 7 High |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62780 | 1 Microsoft | 9 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 6 more | 2026-08-13 | 7 High |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||