Export limit exceeded: 350468 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (350468 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-41612 | 1 Microsoft | 1 Visual Studio Code | 2026-05-12 | 5.5 Medium |
| Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-41610 | 1 Microsoft | 1 Visual Studio Code | 2026-05-12 | 6.3 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-40421 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-05-12 | 4.3 Medium |
| External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-40419 | 1 Microsoft | 4 365 Apps, Office 2019, Office 2021 and 1 more | 2026-05-12 | 7.8 High |
| Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-40417 | 1 Microsoft | 3 Dynamics 365 Business Central 2024, Dynamics 365 Business Central 2025, Dynamics 365 Business Central 2026 | 2026-05-12 | 7.8 High |
| Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-40366 | 1 Microsoft | 7 365 Apps, Office 2019, Office 2021 and 4 more | 2026-05-12 | 8.4 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-40364 | 1 Microsoft | 7 365 Apps, Office 2019, Office 2021 and 4 more | 2026-05-12 | 8.4 High |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-35440 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-05-12 | 5.5 Medium |
| Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-35438 | 1 Microsoft | 1 Windows Admin Center | 2026-05-12 | 8.3 High |
| Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-35433 | 1 Microsoft | 1 .net | 2026-05-12 | 7.3 High |
| Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-34330 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-05-12 | 7.8 High |
| Integer overflow or wraparound in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-33841 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 6 more | 2026-05-12 | 7.8 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-33117 | 1 Microsoft | 1 Azure Sdk For Java | 2026-05-12 | 9.1 Critical |
| Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-32177 | 1 Microsoft | 5 .net, Visual Studio 2017, Visual Studio 2019 and 2 more | 2026-05-12 | 7.3 High |
| Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-41004 | 2 Spring, Vmware | 2 Spring Cloud Config, Spring Cloud Config | 2026-05-12 | 4.4 Medium |
| When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater. | ||||
| CVE-2026-41640 | 1 Nocobase | 1 Nocobase | 2026-05-12 | 7.5 High |
| NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a malicious string primary key can inject arbitrary SQL when any subsequent request triggers recursive eager loading on that collection. This issue has been patched in version 2.0.39. | ||||
| CVE-2026-8401 | 1 Mozilla | 1 Firefox | 2026-05-12 | N/A |
| Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3. | ||||
| CVE-2026-42564 | 1 Fccview | 1 Jotty | 2026-05-12 | 8.2 High |
| jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0. | ||||
| CVE-2026-43897 | 1 Op-engineering | 1 Link-preview-js | 2026-05-12 | N/A |
| Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1. | ||||
| CVE-2026-8319 | 1 Aiwaves-cn | 1 Agents | 2026-05-12 | 5.3 Medium |
| A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this issue is the function recall_relevant_memories_to_working_memory of the file core/cat/looking_glass/stray_cat.py of the component cheshire_cat_core. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. | ||||