Total
13727 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-0025 | 1 Microsoft | 8 Office, Office Compatibility Pack, Office Online Server and 5 more | 2026-10-15 | 9.3 HIGH | 7.3 HIGH |
| Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | |||||
| CVE-2026-93693 | 2026-10-15 | N/A | 6.5 MEDIUM | ||
| In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations. | |||||
| CVE-2026-105717 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-15 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-95631 | 2026-10-15 | N/A | 8.7 HIGH | ||
| Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-92464 | 2026-10-15 | N/A | 9.1 CRITICAL | ||
| Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-46243 | 1 Linux | 1 Linux Kernel | 2026-10-15 | N/A | 7.1 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. | |||||
| CVE-2026-106396 | 1 Google | 2 Android, Chrome | 2026-10-15 | N/A | 5.4 MEDIUM |
| Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2023-24329 | 3 Fedoraproject, Netapp, Python | 6 Fedora, Active Iq Unified Manager, Management Services For Element Software and 3 more | 2026-10-14 | N/A | 7.5 HIGH |
| An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. | |||||
| CVE-2025-64666 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-10-14 | N/A | 7.5 HIGH |
| Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-21124 | 2026-10-14 | N/A | N/A | ||
| Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | |||||
| CVE-2026-21125 | 2026-10-14 | N/A | N/A | ||
| Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | |||||
| CVE-2026-8751 | 1 H2o | 1 H2o | 2026-10-14 | 7.5 HIGH | 7.3 HIGH |
| A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-44319 | 1 Free5gc | 1 Free5gc | 2026-10-14 | N/A | 7.5 HIGH |
| free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier calls NnefPFDmanagementNotify(...) and on any delivery error invokes logger.PFDManageLog.Fatal(err), which is os.Exit(1)-equivalent in Go. An attacker who can create a PFD subscription with an attacker-chosen notifyUri and then trigger a PFD change can deterministically kill NEF on the asynchronous delivery attempt -- the process exits with status 1, dropping NEF's entire SBI surface until restart. This vulnerability is fixed in 4.2.2. | |||||
| CVE-2026-45495 | 1 Microsoft | 1 Edge Chromium | 2026-10-14 | N/A | 8.8 HIGH |
| Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | |||||
| CVE-2026-8959 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 9.6 CRITICAL |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2025-66918 | 1 Hashenudara | 1 Edoc-doctor-appointment-system | 2026-10-14 | N/A | 8.8 HIGH |
| edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter. | |||||
| CVE-2026-45492 | 1 Microsoft | 1 Edge Chromium | 2026-10-14 | N/A | 5.4 MEDIUM |
| Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-42459 | 1 Free5gc | 1 Free5gc | 2026-10-14 | N/A | 7.5 HIGH |
| free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticated attacker can inject control characters into the SUPI parameter, causing UDM to forward a malformed request to UDR and return a 500 Internal Server Error response that exposes internal infrastructure details. This vulnerability is fixed in 4.2.2. | |||||
| CVE-2026-31378 | 1 Apache | 1 Ofbiz | 2026-10-14 | N/A | 6.5 MEDIUM |
| Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. | |||||
| CVE-2026-48922 | 1 Jenkins | 1 Credentials Binding | 2026-10-14 | N/A | 7.5 HIGH |
| Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node. | |||||