Export limit exceeded: 389585 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389585 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-49883 | 2026-09-10 | N/A | ||
| In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-77482 | 1 Microsoft | 6 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 3 more | 2026-09-10 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69734 | 1 Microsoft | 12 365, 365 Apps, Microsoft 365 and 9 more | 2026-09-10 | 6.5 Medium |
| Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-18351 | 2026-09-10 | 9.8 Critical | ||
| The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. | ||||
| CVE-2026-79323 | 2026-09-10 | 7.5 High | ||
| Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql. | ||||
| CVE-2026-79322 | 2026-09-10 | 8.6 High | ||
| SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view. | ||||
| CVE-2026-21107 | 2026-09-10 | N/A | ||
| Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-17084 | 1 Python | 1 Cpython | 2026-09-10 | N/A |
| The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | ||||
| CVE-2026-78449 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-10 | 8.1 High |
| Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78442 | 1 Microsoft | 4 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Sql Server 2017 and 1 more | 2026-09-10 | 8.8 High |
| Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78441 | 1 Microsoft | 6 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 3 more | 2026-09-10 | 6.5 Medium |
| Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-78445 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-09-10 | 9.8 Critical |
| Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-87933 | 1 Davegamble | 1 Cjson | 2026-09-10 | 7.3 High |
| A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-61911 | 1 Cyrusimap | 1 Cyrus Imap | 2026-09-09 | 4.3 Medium |
| An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery. | ||||
| CVE-2026-79513 | 2026-09-09 | 6.5 Medium | ||
| A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640. | ||||
| CVE-2026-71807 | 2026-09-09 | N/A | ||
| In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details (/task/getTask/{taskId}) and trigger unauthorized workflow executions (/task/startWorkFlow). | ||||
| CVE-2026-75307 | 2026-09-09 | N/A | ||
| zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. | ||||
| CVE-2026-71809 | 2026-09-09 | N/A | ||
| Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator. | ||||
| CVE-2026-87647 | 1 Google | 1 Chrome | 2026-09-09 | 3.4 Low |
| Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-87630 | 2026-09-09 | 4.3 Medium | ||
| Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||