Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-114605

dnspython dns.name.from_wire_parser() excessive CPU use

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rthalley
Products
Dnspython
CVE-2026-113764

Windows Projected File System Information Disclosure Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to disclose information locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more
CVE-2026-118597

Akaunting 3.3.0 - Stored XSS in custom invoice payment terms

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Akaunting
Products
Akaunting
CVE-2026-118225

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more
CVE-2026-115207

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 3 more
CVE-2026-43961

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Vim
Products
Enterprise Linux Enterprise Linux Eus Hummingbird and 6 more
CVE-2026-125712

Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-125704

Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-118112

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more