Export limit exceeded: 377104 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377104 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377104 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66301 | 1 Microsoft | 1 Dynamics 365 | 2026-08-11 | 6.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-63530 | 1 Microsoft | 8 365 Apps, Office 2019, Office 2021 and 5 more | 2026-08-11 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-39833 | 1 Golang | 2 Crypto, Ssh | 2026-08-11 | 9.1 Critical |
| The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested. | ||||
| CVE-2026-39832 | 1 Golang | 2 Crypto, Ssh | 2026-08-11 | 9.1 Critical |
| When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them. | ||||
| CVE-2026-73283 | 1 Openbsd | 1 Openssh | 2026-08-11 | 2.5 Low |
| In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. | ||||
| CVE-2026-73282 | 1 Openbsd | 1 Openssh | 2026-08-11 | 4.8 Medium |
| In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. | ||||
| CVE-2026-73281 | 1 Openbsd | 1 Openssh | 2026-08-11 | 3.5 Low |
| In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension. | ||||
| CVE-2026-70316 | 1 Microsoft | 7 365 Apps, Office 2019, Office 2021 and 4 more | 2026-08-11 | 5.5 Medium |
| Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-68809 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-08-11 | 5.5 Medium |
| Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-65777 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-08-11 | 5.3 Medium |
| Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-65769 | 1 Microsoft | 1 Teams | 2026-08-11 | 6.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-64899 | 1 Microsoft | 8 365 Apps, Office 2016, Office 2019 and 5 more | 2026-08-11 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-63531 | 1 Microsoft | 8 365 Apps, Office 2019, Office 2021 and 5 more | 2026-08-11 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-62893 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-08-11 | 9.8 Critical |
| Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62837 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-11 | 6.5 Medium |
| Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-62714 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-08-11 | 6.5 Medium |
| Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. | ||||
| CVE-2026-19075 | 2 Plugins360, Wordpress | 2 All-in-one Video Gallery, Wordpress | 2026-08-11 | 5 Medium |
| All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester. | ||||
| CVE-2026-18666 | 2026-08-11 | 4.3 Medium | ||
| The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. | ||||
| CVE-2026-18030 | 2 Bricksforge, Wordpress | 2 Bricksforge, Wordpress | 2026-08-11 | 8.1 High |
| The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used. | ||||
| CVE-2026-17435 | 1 Rrwo | 1 File::rotate::simple | 2026-08-11 | 2.5 Low |
| File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default. | ||||