Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2015-5477KEVexploit ×10 | 7.5 high | 100.0% | juniper, fedoraproject, junos, fedora, enterprise_linux | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. | 9 Oct |
| CVE-2015-3306KEVexploit ×23 | 10.0 critical | 99.0% | fedoraproject, debian, fedora, debian_linux, tumbleweed | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | 9 Oct |
| CVE-2026-55040exploit ×5 | 9.1 critical | 70.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | 13 h ago |
| CVE-2026-50522exploit ×5 | 9.8 critical | 3.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-63520exploit | 8.1 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-56164exploit ×2 | 5.3 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2018-12122 | 7.5 high | 41.0% | nodejs, suse, node.js, suse_enterprise_storage, suse_linux_enterprise_server | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. | 8 Oct |
| CVE-2017-8512 | 8.8 high | 22.0% | microsoft, office, office_online_server, office_web_apps | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-0260, and CVE-2017-8506. | 15 Oct |
| CVE-2026-58644 | 9.8 critical | 16.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2017-0281 | 7.8 high | 16.0% | microsoft, office, office_online_server, office_web_apps | Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0262. | 15 Oct |
| CVE-2016-0718 | 9.8 critical | 13.0% | mozilla, apple, firefox, mac_os_x, linux_enterprise_debuginfo | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. | 8 Oct |
| CVE-2015-8126 | 7.5 high | 10.0% | libpng, fedoraproject, fedora, leap | Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. | 14 Oct |
| CVE-2018-12116 | 7.5 high | 5.0% | nodejs, suse, node.js, suse_enterprise_storage, suse_linux_enterprise_server | Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server. | 8 Oct |
| CVE-2018-19541 | 8.8 high | 3.0% | jasper_project, canonical, jasper, ubuntu_linux, linux_enterprise_desktop | An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c. | 15 Oct |
| CVE-2026-66808 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-64901 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-65663 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-65658 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-63514 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2018-19540 | 8.8 high | 2.0% | jasper_project, suse, jasper, linux_enterprise_desktop, linux_enterprise_server | An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c. | 15 Oct |
| CVE-2018-19543 | 7.8 high | 2.0% | jasper_project, canonical, jasper, ubuntu_linux, debian_linux | An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. | 15 Oct |
| CVE-2026-63516 | 6.5 medium | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2018-19542 | 6.5 medium | 2.0% | jasper_project, canonical, jasper, ubuntu_linux, linux_enterprise_desktop | An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service. | 15 Oct |
| CVE-2018-19539 | 6.5 medium | 2.0% | jasper_project, suse, jasper, linux_enterprise_desktop, linux_enterprise_server | An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service. | 15 Oct |
| CVE-2026-70306 | 9.3 critical | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-64921 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-70324 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-58277 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-55052 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-62827 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-17556 | 8.8 high | 1.0% | github, enterprise_server | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for the upload buffer directory, so a traversal value pointed the buffer at an arbitrary path and the deferred cleanup routine recursively removed the traversed target. Exploitation required only network reachability to the instance and no authentication, and it worked even when private mode was enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. This vulnerability was reported via the GitHub Bug Bounty program. | Fri 23 Oct |
| CVE-2026-15343 | 8.6 high | 1.0% | no CPE yet | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, an injected workflow could execute with access to the repository's GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18. | Sat 24 Oct |
| CVE-2025-11892 | 8.6 high | 1.0% | github, enterprise_server | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a user, while operating in sudo mode, to click on a crafted malicious link to perform actions that require elevated privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.1, 3.17.7, 3.16.10, 3.15.14, 3.14.19. | 18 Oct |
| CVE-2026-8034 | 7.9 high | 1.0% | github, enterprise_server | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program. | Mon 26 Oct |
| CVE-2026-55130 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55128 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55134 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55132 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55038 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55055 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55127 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55033 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2026-55032 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 13 h ago |
| CVE-2020-8022 | 7.8 high | 1.0% | apache, opensuse, tomcat, leap | A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1. | 8 Oct |
| CVE-2026-64900 | 7.3 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-55126 | 7.3 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-55034 | 7.3 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-55021 | 7.3 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-15996 | 6.6 medium | 1.0% | github, enterprise_server | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16. | Fri 23 Oct |
| CVE-2026-62839 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
50 of 102 · Next
Download these 102 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.