Export limit exceeded: 99874 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (99874 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87842 | 2026-09-12 | 7.5 High | ||
| The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account. | ||||
| CVE-2026-84099 | 2026-09-12 | 8.1 High | ||
| The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site. | ||||
| CVE-2026-84047 | 2026-09-12 | 8.6 High | ||
| The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-81090 | 2026-09-12 | 7.2 High | ||
| The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution. | ||||
| CVE-2026-80491 | 2026-09-12 | 8.6 High | ||
| The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks. | ||||
| CVE-2026-81954 | 1 Microsoft | 18 365, 365 Apps, Excel and 15 more | 2026-09-12 | 7.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-72973 | 1 Microsoft | 15 365, 365 Apps, Microsoft 365 and 12 more | 2026-09-12 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-76202 | 1 Adobe | 6 Adobe Commerce, Adobe Commerce B2b, Commerce and 3 more | 2026-09-12 | 8.2 High |
| Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-71647 | 2026-09-12 | 7.5 High | ||
| An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in ego_replan_fsm.cpp | ||||
| CVE-2026-79592 | 1 Libxls | 1 Libxls | 2026-09-12 | 7.5 High |
| An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets. | ||||
| CVE-2026-58874 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-89266 | 1 Stb Vorbis Project | 1 Stb Vorbis | 2026-09-11 | 8.2 High |
| stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption. | ||||
| CVE-2026-86169 | 1 Axolotl-ai-cloud | 1 Axolotl | 2026-09-11 | 8.8 High |
| Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained. | ||||
| CVE-2026-78514 | 1 Microsoft | 11 365, 365 Apps, Microsoft 365 and 8 more | 2026-09-11 | 8.8 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-84000 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-11 | 7.8 High |
| Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. | ||||
| CVE-2026-83985 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-11 | 7.8 High |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-81353 | 1 Microsoft | 1 Heif Image Extension | 2026-09-11 | 7.8 High |
| Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-78462 | 1 Microsoft | 1 Visual Studio Code | 2026-09-11 | 8.8 High |
| Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-78457 | 1 Microsoft | 9 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 6 more | 2026-09-11 | 7 High |
| Use after free in Windows Security Health Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-78444 | 1 Microsoft | 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more | 2026-09-11 | 8.1 High |
| Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | ||||