Export limit exceeded: 376916 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 376916 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 376916 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376916 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66809 | 1 Microsoft | 8 365 Apps, Office 2019, Office 2021 and 5 more | 2026-08-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-65778 | 1 Microsoft | 2 Windows 11 24h2, Windows 11 25h2 | 2026-08-13 | 7 High |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-63300 | 1 Canonical | 1 Lxd | 2026-08-13 | 9.9 Critical |
| An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance's configuration against the target project's enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project. | ||||
| CVE-2026-62917 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-13 | 4.6 Medium |
| Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-62839 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-13 | 6.5 Medium |
| Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-59917 | 1 Dell | 1 Display And Peripheral Manager | 2026-08-13 | 7.8 High |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | ||||
| CVE-2026-59916 | 1 Dell | 1 Display And Peripheral Manager | 2026-08-13 | 7.8 High |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | ||||
| CVE-2026-59914 | 1 Dell | 1 Display And Peripheral Manager | 2026-08-13 | 7.8 High |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | ||||
| CVE-2026-56179 | 1 Microsoft | 7 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 4 more | 2026-08-13 | 8.3 High |
| Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. | ||||
| CVE-2026-55040 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-13 | 9.1 Critical |
| Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-47705 | 1 Baptistearno | 1 Typebot.io | 2026-08-13 | 9.6 Critical |
| TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue. | ||||
| CVE-2026-3835 | 2 Buildwps, Wordpress | 2 Prevent Direct Access – Protect Wordpress Files, Wordpress | 2026-08-13 | 5.3 Medium |
| The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file. | ||||
| CVE-2026-19003 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-08-13 | 7.8 High |
| A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog. | ||||
| CVE-2026-18726 | 1 Redhat | 2 Enterprise Linux, Open Iscsi | 2026-08-13 | 6.5 Medium |
| A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed. | ||||
| CVE-2026-17642 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-17417 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters. | ||||
| CVE-2026-17083 | 1 Ibm | 1 I | 2026-08-13 | 9.8 Critical |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. | ||||
| CVE-2026-17082 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name. | ||||
| CVE-2026-16480 | 1 Ibm | 1 Db2 | 2026-08-13 | 4.3 Medium |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. | ||||
| CVE-2026-13361 | 1 Ibm | 1 Informix Dynamic Server | 2026-08-13 | 8.8 High |
| IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. | ||||