Export limit exceeded: 377263 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377263 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65681 | 1 Microsoft | 9 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 6 more | 2026-08-14 | 7.5 High |
| Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-65679 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-08-14 | 8.1 High |
| Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-66809 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-08-14 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-70317 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-08-14 | 5.5 Medium |
| Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-19680 | 2026-08-14 | 7.1 High | ||
| A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. | ||||
| CVE-2026-73849 | 2026-08-14 | 9.8 Critical | ||
| Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review. | ||||
| CVE-2026-65777 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-08-14 | 5.3 Medium |
| Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-19679 | 2026-08-14 | 8.8 High | ||
| An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue. | ||||
| CVE-2026-65672 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-63521 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-08-14 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-73847 | 2026-08-14 | 6.8 Medium | ||
| Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review. | ||||
| CVE-2026-46439 | 1 Oscal-compass | 1 Compliance-trestle | 2026-08-14 | 7.8 High |
| compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads into data fields (such as SSP documents or Lookup Tables). The vulnerability does not require attacker control of the template itself. Only attacker-controlled input data rendered into a trusted template is required. This distinction is critical: the template author may only intend to render plain text (e.g., `Title: {{ ssp.metadata.title }}`), but because of the recursive parsing, the data field itself becomes executable. The vulnerability is caused by recursive re-compilation and re-rendering of already-rendered output. Versions 3.12.3 and 4.0.3 patch the issue. | ||||
| CVE-2026-47766 | 1 Containers | 1 Crun | 2026-08-14 | N/A |
| crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named `ptmx` in the target directory was also replaced by crun's forced `ptmx -> pts/ptmx` symlink. Version 1.28 fixes the issue. | ||||
| CVE-2026-19847 | 1 Totolink | 1 A800r Firmware | 2026-08-14 | 8.8 High |
| A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-70323 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2019 and 5 more | 2026-08-14 | 5.5 Medium |
| Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-68792 | 1 Microsoft | 4 365 Apps, Office 2019, Office 2021 and 1 more | 2026-08-14 | 7.8 High |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-64910 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2019 and 5 more | 2026-08-14 | 7.8 High |
| Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-63701 | 2026-08-14 | 6.3 Medium | ||
| Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation. | ||||
| CVE-2026-56864 | 2 Golang, Gotoolchain | 2 Mod, Cmd/go | 2026-08-14 | 7.5 High |
| A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy | ||||
| CVE-2026-49989 | 2026-08-14 | N/A | ||
| CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of `GRANT`s. CrateDB has two ways to access blob storage: SQL (`SELECT ... FROM blob.<table>` and friends) and the blob HTTP API (`GET|PUT|DELETE /_blobs/{table}/{digest}`). The SQL path goes through `AccessControl`, which is what enforces privilege grants; that's why `SELECT digest FROM blob.secret_blobs` fails for a user who has no grants on the table. The HTTP path authenticates the request but never asks `AccessControl` whether the authenticated user is allowed to touch the table. So a user with no grants gets `MissingPrivilegeException` from SQL and `200 OK` plus the blob bytes from `GET /_blobs/secret_blobs/<digest>`. Deployments that don't use `BLOB TABLE` are unaffected. Authentication itself still works; the bug is strictly that being authenticated as anyone is treated as sufficient for any blob op. Versions 6.2.8 and 6.3.2 fix the issue. | ||||