Export limit exceeded: 377254 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377254 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58651 | 1 Microsoft | 7 365 Apps, Microsoft 365, Office 2021 and 4 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-65662 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-14 | 5.5 Medium |
| Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-65671 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65790 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65814 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-33818 | 1 Go Standard Library | 1 Encoding/asn1 | 2026-08-14 | 7.5 High |
| Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | ||||
| CVE-2026-19844 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-19628 | 1 Tenable | 1 Security Center | 2026-08-14 | 7.2 High |
| A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered. | ||||
| CVE-2026-19845 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-19629 | 1 Tenable | 1 Security Center | 2026-08-14 | 8.1 High |
| A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management. | ||||
| CVE-2026-19846 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-66799 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70307 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-08-14 | 7 High |
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-0301 | 1 Palo Alto Networks | 3 Cloud Ngfw, Pan-os, Prisma Access | 2026-08-14 | N/A |
| An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability. | ||||
| CVE-2026-49457 | 2026-08-14 | 9.1 Critical | ||
| erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could present any certificate and impersonate any server, defeating the confidentiality and integrity of the connection. HTTP/3 uses the same client and was equally affected. Handshakes authenticated by a PSK (session resumption) are not affected, because the peer is authenticated by the PSK binder and no certificate is sent. This is fixed in 1.4.4. The client now verifies the CertificateVerify signature, validates the certificate chain against the trust store (`cacerts` option, the operating system store by default), and checks the hostname. Client `verify` now defaults to on; set `verify => false` to accept any certificate (for example a self-signed test server). No known workarounds are available before 1.4.4. `verify => true` had no effect, and inspecting the certificate after connecting does not help because without the signature check the peer is never proven to own the certificate it presents. | ||||
| CVE-2026-62819 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-14 | 8.1 High |
| Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | ||||
| CVE-2026-19188 | 2026-08-14 | 10 Critical | ||
| A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges. | ||||
| CVE-2026-72971 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-08-14 | 5.5 Medium |
| Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-70348 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-08-14 | 5.5 Medium |
| Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally. | ||||
| CVE-2026-65791 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-08-14 | 9.8 Critical |
| Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network. | ||||