Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,180 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-102867 | 6.5 Medium | Microsoft Office Word Information Disclosure Vulnerability | Oct 13, 2026 |
| CVE-2026-102866 | 8.1 High | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-102865 | 6.5 Medium | Microsoft Office SharePoint Information Disclosure Vulnerability | Oct 13, 2026 |
| CVE-2026-102864 | 4.6 Medium | Microsoft Office SharePoint Spoofing Vulnerability | Oct 13, 2026 |
| CVE-2026-102863 | 8.8 High | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-102862 | 8.8 High | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-102861 | 8.8 High | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-102860 | 8.8 High | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-102859 | 4.6 Medium | Microsoft Office SharePoint Spoofing Vulnerability | Oct 13, 2026 |
| CVE-2026-102858 | 8.8 High | Microsoft Office OneNote Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102857 | 8.8 High | Microsoft Office Visio Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102856 | 8.8 High | Microsoft Office Visio Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102855 | 8.8 High | Microsoft Office Visio Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-70098 | 8.8 High | Visual Studio Code Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102238 | 9.6 Critical | Visual Studio Code Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102235 | 8.8 High | Visual Studio Code Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102234 | 7.4 High | Visual Studio Code Security Feature Bypass Vulnerability | Oct 13, 2026 |
| CVE-2026-102233 | 7.8 High | Visual Studio Code Security Feature Bypass Vulnerability | Oct 13, 2026 |
| CVE-2026-102232 | 7.0 High | Visual Studio Code Security Feature Bypass Vulnerability | Oct 13, 2026 |
| CVE-2026-102231 | 7.7 High | Visual Studio Code Security Feature Bypass Vulnerability | Oct 13, 2026 |
| CVE-2026-102229 | 6.8 Medium | Visual Studio Code Information Disclosure Vulnerability | Oct 13, 2026 |
| CVE-2026-102227 | 7.8 High | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-108468 | 7.0 High | Windows Installer Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-108457 | 8.1 High | Microsoft Windows PDF Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-108400 | 8.8 High | HEVC Video Extensions Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-105728 | 7.5 High | Dynamics Business Central Information Disclosure Vulnerability | Oct 13, 2026 |
| CVE-2026-105727 | 8.8 High | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-105725 | 7.0 High | Windows Security App Elevation of Privilege Vulnerability | Oct 13, 2026 |
| CVE-2026-103572 | 8.8 High | Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102850 | 8.8 High | Microsoft Office Access Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-102849 | 8.8 High | Microsoft Office Access Remote Code Execution Vulnerability | Oct 13, 2026 |
| CVE-2026-110240 | 6.3 Medium | Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP | Oct 13, 2026 |
| CVE-2026-110239 | 2.1 Low | Rapyd Admin before 9.20.0 Stored XSS via rich-text Component | Oct 13, 2026 |
| CVE-2026-110238 | 8.7 High | Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component | Oct 13, 2026 |
| CVE-2026-110237 | 7.0 High | Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution | Oct 13, 2026 |
| CVE-2026-110236 | 7.1 High | KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name | Oct 13, 2026 |
| CVE-2026-110235 | 6.7 Medium | MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass | Oct 13, 2026 |
| CVE-2026-110234 | 4.1 Medium | Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture | Oct 13, 2026 |
| CVE-2026-110233 | 8.4 High | rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe | Oct 13, 2026 |
| CVE-2026-110232 | 4.6 Medium | Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity | Oct 13, 2026 |
| CVE-2026-110231 | 5.6 Medium | muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP | Oct 13, 2026 |
| CVE-2026-110230 | 5.3 Medium | XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint | Oct 13, 2026 |
| CVE-2026-110229 | 5.3 Medium | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips | Oct 13, 2026 |
| CVE-2026-110228 | 5.1 Medium | wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload | Oct 13, 2026 |
| CVE-2026-110226 | 5.3 Medium | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation | Oct 13, 2026 |
| CVE-2026-110225 | 5.1 Medium | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route | Oct 13, 2026 |
| CVE-2026-110224 | 5.1 Medium | QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors | Oct 13, 2026 |
| CVE-2026-110223 | 2.3 Low | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint | Oct 13, 2026 |
| CVE-2026-110222 | 6.9 Medium | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup | Oct 13, 2026 |
| CVE-2026-110221 | 5.1 Medium | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.