Export limit exceeded: 374397 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374397 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-8029 | 1 Zte | 1 Smartlife | 2026-08-07 | 3.9 Low |
| The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data. | ||||
| CVE-2026-14304 | 1 Eclipse | 1 Eclipse Accessibility Tools Framework | 2026-08-07 | N/A |
| In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker. | ||||
| CVE-2026-12609 | 1 Eclipse | 1 Eclipse Theia | 2026-08-07 | 7.5 High |
| In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files readable by the Theia backend process to be retrieved. Plugin IDs are derived deterministically from a plugin's publisher and name, so built-in plugins serve as reliable anchors that require no prior knowledge of the target system. | ||||
| CVE-2026-12070 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-71559 | 1 Apache | 1 Fory | 2026-08-07 | N/A |
| Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue. | ||||
| CVE-2026-55034 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 7.3 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-55045 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 8.4 High |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55127 | 1 Microsoft | 12 365 Apps, Office 2019, Office 2021 and 9 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55136 | 1 Microsoft | 13 365 Apps, Excel 2016, Microsoft 365 Apps For Enterprise and 10 more | 2026-08-07 | 7.8 High |
| Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55035 | 1 Microsoft | 19 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office 365 For Mac and 16 more | 2026-08-07 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-55057 | 1 Microsoft | 9 365 Apps, Microsoft 365 Apps For Enterprise, Office 2016 and 6 more | 2026-08-07 | 5.5 Medium |
| Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-55051 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 6.5 Medium |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-55040 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 9.1 Critical |
| Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-55142 | 1 Microsoft | 12 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 9 more | 2026-08-07 | 5.5 Medium |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-55128 | 1 Microsoft | 13 365 Apps, Microsoft Office 365 For Mac, Office 2019 and 10 more | 2026-08-07 | 7.8 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55130 | 1 Microsoft | 9 365 Apps, Office 2019, Office 2021 and 6 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55120 | 1 Microsoft | 12 365 Apps, Microsoft 365 Apps For Enterprise, Microsoft Office Ltsc For Mac 2021 and 9 more | 2026-08-07 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55135 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 4.6 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-56157 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 5.4 Medium |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-56159 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-08-07 | 9.8 Critical |
| Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | ||||