Export limit exceeded: 105446 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (105446 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-88165 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 8.8 High |
| Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-88177 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-10-17 | 7.8 High |
| Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-42702 | 2 Themeum, Wordpress-extensions | 2 Tutor Lms, Tutor Lms | 2026-10-17 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | ||||
| CVE-2026-69766 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-17 | 7 High |
| Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-59963 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 7.1 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10. | ||||
| CVE-2026-61726 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 8.1 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12. | ||||
| CVE-2026-59970 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 7.7 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10. | ||||
| CVE-2026-30971 | 1 Zoneminder | 1 Zoneminder | 2026-10-17 | 8.8 High |
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40. | ||||
| CVE-2026-49410 | 1 Tinyhumansai | 1 Openhuman | 2026-10-17 | 8.1 High |
| OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0. | ||||
| CVE-2026-69783 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-17 | 7.8 High |
| External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69789 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-10-17 | 7.5 High |
| Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-102607 | 1 Zoneminder | 1 Zoneminder | 2026-10-17 | 8.8 High |
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3. | ||||
| CVE-2026-83883 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 7.8 High |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-108374 | 1 Frappe | 1 Erpnext | 2026-10-17 | 7.7 High |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0. | ||||
| CVE-2026-69363 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-10-17 | 8 High |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69387 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-10-17 | 7 High |
| Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83915 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-17 | 7 High |
| Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69673 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-17 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69718 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-17 | 7.8 High |
| Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69733 | 1 Microsoft | 12 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 9 more | 2026-10-17 | 7.8 High |
| Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | ||||