2026 CVEs (page 635)
Page 635 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21352 | High | 7.8 | 2026-02-10 | DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21347 | High | 7.8 | 2026-02-10 | Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the… |
CVE-2026-21346 | High | 7.8 | 2026-02-10 | Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-21345 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2026-21344 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2026-21343 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2026-21342 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-21341 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-1850 | Medium | 6.5 | 2026-02-10 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. |
CVE-2026-1849 | Medium | 6.5 | 2026-02-10 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functio… |
CVE-2026-1848 | High | 7.5 | 2026-02-10 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections excee… |
CVE-2026-1847 | Medium | 6.5 | 2026-02-10 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall… |
CVE-2026-26003 | Medium | 5.4 | 2026-02-10 | FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authent… |
CVE-2026-25993 | Critical | 9.8 | 2026-02-10 | EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derive… |
CVE-2026-25992 | High | 7.5 | 2026-02-10 | SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to… |
CVE-2026-25956 | Medium | 6.1 | 2026-02-10 | Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could l… |
CVE-2026-25947 | High | 8.8 | 2026-02-10 | Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affec… |
CVE-2026-25805 | Medium | 6.4 | 2026-02-10 | Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does… |
CVE-2026-25728 | High | 7.5 | 2026-02-10 | ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in Cl… |
CVE-2026-25646 | High | 8.1 | 2026-02-10 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an… |
CVE-2026-25612 | Medium | 6.5 | 2026-02-10 | The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadverte… |
CVE-2026-25611 | High | 7.5 | 2026-02-10 | A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server. |
CVE-2026-25577 | High | 7.5 | 2026-02-10 | Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle… |
CVE-2026-24045 | High | 7.3 | 2026-02-10 | Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not pr… |
CVE-2026-23655 | Medium | 6.5 | 2026-02-10 | Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-21537 | High | 8.8 | 2026-02-10 | Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent netw… |
CVE-2026-21533 | High | 7.8 | 2026-02-10 | Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. |
CVE-2026-21531 | Critical | 9.8 | 2026-02-10 | Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network. |
CVE-2026-21529 | Medium | 5.7 | 2026-02-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over… |
CVE-2026-21528 | Medium | 6.5 | 2026-02-10 | Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21527 | Medium | 6.5 | 2026-02-10 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-21525 | Medium | 6.2 | 2026-02-10 | Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. |
CVE-2026-21523 | High | 8.0 | 2026-02-10 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. |
CVE-2026-21522 | Medium | 6.7 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privilege… |
CVE-2026-21519 | High | 7.8 | 2026-02-10 | Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-21518 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
CVE-2026-21517 | Medium | 4.7 | 2026-02-10 | Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally. |
CVE-2026-21516 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a ne… |
CVE-2026-21514 | High | 7.8 | 2026-02-10 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-21513 | High | 8.8 | 2026-02-10 | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-21512 | Medium | 6.5 | 2026-02-10 | Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network. |
CVE-2026-21511 | High | 7.5 | 2026-02-10 | Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-21510 | High | 8.8 | 2026-02-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-21508 | High | 7.0 | 2026-02-10 | Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally. |
CVE-2026-21358 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in application denial-of-servic… |
CVE-2026-21357 | High | 7.8 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21351 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21350 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker… |
CVE-2026-21340 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21339 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21338 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. A… |
CVE-2026-21337 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21336 | Medium | 5.5 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. A… |
CVE-2026-21335 | High | 7.8 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21334 | High | 7.8 | 2026-02-10 | Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21332 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21330 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arb… |
CVE-2026-21329 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21328 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21327 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21326 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21325 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21324 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21323 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21322 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21321 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21320 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21319 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-21318 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21317 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21316 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-serv… |
CVE-2026-21315 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21314 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21313 | Medium | 5.5 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vuln… |
CVE-2026-21312 | High | 7.8 | 2026-02-10 | Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2026-21261 | Medium | 5.5 | 2026-02-10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21260 | High | 7.5 | 2026-02-10 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-21259 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-21258 | Medium | 5.5 | 2026-02-10 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21257 | High | 8.0 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevat… |
CVE-2026-21256 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2026-21255 | High | 8.8 | 2026-02-10 | Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
CVE-2026-21253 | High | 7.0 | 2026-02-10 | Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-21251 | High | 7.8 | 2026-02-10 | Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally. |
CVE-2026-21250 | High | 7.8 | 2026-02-10 | Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21249 | Low | 3.3 | 2026-02-10 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-21248 | High | 7.3 | 2026-02-10 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21247 | High | 7.3 | 2026-02-10 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21246 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-21245 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-21244 | High | 7.3 | 2026-02-10 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21243 | High | 7.5 | 2026-02-10 | Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2026-21242 | High | 7.0 | 2026-02-10 | Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2026-21241 | High | 7.0 | 2026-02-10 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21240 | High | 7.8 | 2026-02-10 | Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-21239 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-21238 | High | 7.8 | 2026-02-10 | Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21237 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to ele… |
CVE-2026-21236 | High | 7.8 | 2026-02-10 | Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-21235 | High | 7.3 | 2026-02-10 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |