CVE-2026-96xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
522 records · Page 6 of 6
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
UpdatedHeap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
UpdatedThe Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
UpdatedHeap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
UpdatedIncomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
UpdatedUse after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
UpdatedExternal control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
UpdatedDeserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
UpdatedStack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
UpdatedMissing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
Updated- CVE-2026-96173: Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR 5.3 Medium
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
Updated IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
UpdatedOut-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
UpdatedNo cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
UpdatedThe BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacke
UpdatedIBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.
Updated