Export limit exceeded: 101103 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (101103 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62913 | 1 Microsoft | 9 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 6 more | 2026-08-14 | 8.8 High |
| Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-62803 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-08-14 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-56865 | 2 Golang, Gotoolchain | 2 Mod, Cmd/go | 2026-08-14 | 8.4 High |
| A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy | ||||
| CVE-2026-28154 | 2 Snstheme, Wordpress | 3 M.anh - Fashion Woocoommerce Wordpress Theme, Samex - Clean, Minimal Shop Woocommerce Wordpress Theme, Wordpress | 2026-08-14 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7. | ||||
| CVE-2026-19814 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-19762 | 1 Dtstack | 1 Taier | 2026-08-14 | 7.3 High |
| A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-19753 | 1 Model Context Protocol | 1 Mcp-rdf-explorer | 2026-08-14 | 7.3 High |
| A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-18509 | 1 Ibm | 1 I | 2026-08-14 | 8.2 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system. | ||||
| CVE-2026-15205 | 2026-08-14 | 8.6 High | ||
| The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction. | ||||
| CVE-2026-48438 | 1 Adobe | 6 C2pa, C2pa-web, C2patool and 3 more | 2026-08-14 | 7.5 High |
| CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48439 | 1 Adobe | 6 C2pa, C2pa-web, C2patool and 3 more | 2026-08-14 | 7.5 High |
| CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48442 | 1 Adobe | 6 C2pa, C2pa-web, C2patool and 3 more | 2026-08-14 | 7.1 High |
| CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-65661 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-70337 | 1 Microsoft | 1 Powershell | 2026-08-14 | 8.8 High |
| Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70329 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-08-14 | 8.8 High |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-65657 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2019 and 5 more | 2026-08-14 | 7.8 High |
| Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64911 | 1 Microsoft | 15 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 12 more | 2026-08-14 | 7.8 High |
| Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-63513 | 1 Microsoft | 17 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 14 more | 2026-08-14 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-13380 | 1 Vsee | 2 Clinic, Clinic Api | 2026-08-14 | 7.5 High |
| VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server. | ||||
| CVE-2026-13381 | 1 Vsee | 2 Clinic, Clinic Api | 2026-08-14 | 8.1 High |
| VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server. | ||||