Export limit exceeded: 381500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55483 | 1 Grokability | 1 Snipe-it | 2026-08-19 | N/A |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0. | ||||
| CVE-2026-55519 | 1 Grokability | 1 Snipe-it | 2026-08-19 | 5.4 Medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1. | ||||
| CVE-2026-61807 | 1 Grokability | 1 Snipe-it | 2026-08-19 | N/A |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2. | ||||
| CVE-2026-55643 | 1 Grokability | 1 Snipe-it | 2026-08-19 | N/A |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3. | ||||
| CVE-2026-16836 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||
| CVE-2026-16834 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 9.8 Critical |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow. | ||||
| CVE-2026-16833 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 5.3 Medium |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read. | ||||
| CVE-2026-16831 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||
| CVE-2026-16829 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 5.3 Medium |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. | ||||
| CVE-2026-16825 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 4.2 Medium |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write. | ||||
| CVE-2026-16824 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion. | ||||
| CVE-2026-74228 | 2026-08-19 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-74227 | 2026-08-19 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-74226 | 2026-08-19 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-16822 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 9.3 Critical |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation. | ||||
| CVE-2026-33327 | 1 Libvips | 1 Libvips | 2026-08-19 | 7.8 High |
| libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1. | ||||
| CVE-2021-26858 | 1 Microsoft | 1 Exchange Server | 2026-08-19 | 7.8 High |
| Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2021-42292 | 1 Microsoft | 10 365 Apps, Excel, Excel 2013 and 7 more | 2026-08-19 | 7.8 High |
| Microsoft Excel Security Feature Bypass Vulnerability | ||||
| CVE-2021-42287 | 1 Microsoft | 11 Windows Server 2004, Windows Server 2008, Windows Server 2008 R2 and 8 more | 2026-08-19 | 7.5 High |
| Active Directory Domain Services Elevation of Privilege Vulnerability | ||||
| CVE-2021-27065 | 1 Microsoft | 1 Exchange Server | 2026-08-19 | 7.8 High |
| Microsoft Exchange Server Remote Code Execution Vulnerability | ||||