Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS medium ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-59837 | 6.6 medium | 1.0% | fortinet, fortiproxy, fortios, fortipam | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests. | 24 Oct |
| CVE-2026-73645 | 6.6 medium | 1.0% | no CPE yet | OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint operation could fail silently. The wrap and onTransferReceived functions in contracts/token/ERC7984/extensions/ERC7984ERC20Wrapper.sol did not handle that failure, so a user could transfer the underlying token without receiving the corresponding confidential wrapped token. With the default rate(), the wrapper fills after approximately 18.4 trillion tokens, and subsequent wrapping requests can cause loss of funds. This issue is fixed in version 0.3.1. | 24 Oct |
| CVE-2026-15996 | 6.6 medium | 1.0% | github, enterprise_server | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16. | 23 Oct |
| CVE-2026-45819 | 6.6 medium | 1.0% | no CPE yet | baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service. | 23 Oct |
| CVE-2026-83945 | 6.6 medium | 1.0% | no CPE yet | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-85841 | 6.6 medium | 1.0% | no CPE yet | Use after free in Windows DHCP Server allows an authorized attacker to execute code over a network. | 19 Oct |
| CVE-2025-4619 | 6.6 medium | 1.0% | no CPE yet | A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. This issue is applicable to the PAN-OS software versions listed below on PA-Series firewalls, VM-Series firewalls, and Prisma® Access software. This issue does not affect Cloud NGFW. We have successfully completed the Prisma Access upgrade for all customers, with the exception of those facing issues such as conflicting maintenance windows. Remaining customers will be promptly scheduled for an upgrade through our standard upgrade process. | 18 Oct |
| CVE-2025-13646 | 6.6 medium | 1.0% | wpchill, modula_image_gallery | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible. | 18 Oct |
| CVE-2026-101216 | 6.6 medium | 1.0% | no CPE yet | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | 15 Oct |
| CVE-2026-101215 | 6.6 medium | 1.0% | no CPE yet | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | 15 Oct |
| CVE-2022-3628 | 6.6 medium | 1.0% | linux, linux_kernel | A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. | 14 Oct |
| CVE-2024-5042 | 6.6 medium | 1.0% | no CPE yet | A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster. | 14 Oct |
| CVE-2026-14280 | 6.6 medium | 1.0% | no CPE yet | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal key is subsequently executed via an include_once() call that fires on every admin_init invocation — including unauthenticated admin-ajax.php requests — meaning once the malicious key is stored by an administrator, the inclusion is triggered without any further authentication or capability check. | 12 Oct |
| CVE-2025-59432 | 6.6 medium | 1.0% | no CPE yet | SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison. | 11 Oct |
| CVE-2022-0213 | 6.6 medium | 1.0% | vim, debian, debian_linux | vim is vulnerable to Heap-based Buffer Overflow | 8 Oct |
| CVE-2026-102135 | 6.6 medium | 1.0% | accellion, kiteworks | On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance. | 8 Oct |
| CVE-2026-102133 | 6.6 medium | 1.0% | accellion, kiteworks | An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control. | 8 Oct |
| CVE-2026-58539 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-58546 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-58535 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-58533 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-57982 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-56168 | 6.5 medium | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 | Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network. | 6 h ago |
| CVE-2026-54116 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) | Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-50468 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-55051 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-55054 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-54126 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-50504 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-50497 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-50445 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-50376 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-50366 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 6 h ago |
| CVE-2026-49799 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. | 6 h ago |
| CVE-2026-57979 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2026-57976 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 6 h ago |
| CVE-2026-54108 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 6 h ago |
| CVE-2026-55003 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 6 h ago |
| CVE-2024-9676 | 6.5 medium | 1.0% | red hat, red hat enterprise linux 8, red hat enterprise linux 9, red hat enterprise linux 9.4 extended update support | A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host. | 18 h ago |
| CVE-2026-66303 | 6.5 medium | 1.0% | microsoft, skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 | Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network. | Sat 31 Oct |
| CVE-2026-80082 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80090 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80089 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80091 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80088 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80087 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80086 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80084 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80076 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
| CVE-2026-80078 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | Sat 31 Oct |
950 of 18957 · Next · Previous
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.