Export limit exceeded: 390637 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390637 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81958 | 1 Microsoft | 12 365 Apps, Excel, Excel 2016 and 9 more | 2026-09-12 | 5.5 Medium |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-87719 | 1 Gitlab | 1 Gitlab | 2026-09-12 | 9.9 Critical |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup. | ||||
| CVE-2026-80788 | 1 Linux | 1 Linux Kernel | 2026-09-12 | 6.2 Medium |
| In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags. | ||||
| CVE-2026-81394 | 1 Microsoft | 21 365, 365 Apps, Excel and 18 more | 2026-09-12 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-71647 | 2026-09-12 | 7.5 High | ||
| An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in ego_replan_fsm.cpp | ||||
| CVE-2026-0054 | 1 Google | 1 Android | 2026-09-12 | 3.3 Low |
| In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-90467 | 2026-09-12 | 4 Medium | ||
| aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties. | ||||
| CVE-2026-89268 | 1 Webkul | 1 Qloapps | 2026-09-12 | 5.4 Medium |
| QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions. | ||||
| CVE-2026-89267 | 1 Encode | 1 Starlette | 2026-09-12 | 4.3 Medium |
| starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns. | ||||
| CVE-2026-79592 | 1 Libxls | 1 Libxls | 2026-09-12 | 7.5 High |
| An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets. | ||||
| CVE-2026-87910 | 2026-09-12 | N/A | ||
| When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None. | ||||
| CVE-2026-89161 | 1 Pcre | 1 Pcre2 | 2026-09-12 | 7.4 High |
| In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. | ||||
| CVE-2026-87875 | 2 Openprinting, Redhat | 6 Cups, Enterprise Linux, Hardened Images and 3 more | 2026-09-11 | 4.3 Medium |
| The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content. | ||||
| CVE-2026-28622 | 1 Google | 1 Android | 2026-09-11 | 3.3 Low |
| In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28660 | 1 Google | 1 Android | 2026-09-11 | 3.3 Low |
| In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-89266 | 1 Stb Vorbis Project | 1 Stb Vorbis | 2026-09-11 | 8.2 High |
| stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption. | ||||
| CVE-2026-86169 | 1 Axolotl-ai-cloud | 1 Axolotl | 2026-09-11 | 8.8 High |
| Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained. | ||||
| CVE-2026-89013 | 1 Dolibarr | 1 Dolibarr | 2026-09-11 | 7.5 High |
| Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. | ||||
| CVE-2026-84000 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-11 | 7.8 High |
| Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. | ||||
| CVE-2026-83985 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-11 | 7.8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||