Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,880

CVE-2026-109756

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-102866

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-105726

Microsoft Defender Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Defender For Endpoint
CVE-2026-105731

Microsoft Office Graphics Component Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office
CVE-2026-109741

Use-after-free in the Storage: Bucket File System component

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-109751

Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-109761

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-109765

Race condition, use-after-free in the Graphics: Text component

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-109767

Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-102226

Dynamics Business Central Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
Dynamics Nav 2018
CVE-2026-100214

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Microsoft
Products
Dynamics Nav 2017 Dynamics Nav 2018
CVE-2026-84256

OpenVPN: OpenVPN: Arbitrary command execution via crafted certificate subject

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-100207

Azure CycleCloud Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-96188

Microsoft PowerToys Elevation of Privilege Vulnerability

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Power Toys
CVE-2026-70343

Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Mpeg-2 Video Extension
CVE-2026-88206

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-88200

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server