Export limit exceeded: 388875 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 388875 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (388875 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82060 | 1 Mongodb | 1 Mongodb Server | 2026-09-08 | 5.4 Medium |
| In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors. | ||||
| CVE-2026-81960 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81955 | 1 Microsoft | 22 365 Apps, Office 2016, Office 2019 and 19 more | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-81950 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 7.8 High |
| Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81400 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81395 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81390 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81385 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-09-08 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-81377 | 1 Microsoft | 1 Visual Studio Code | 2026-09-08 | 6.5 Medium |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-80255 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host. | ||||
| CVE-2026-80231 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created. | ||||
| CVE-2026-80230 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. | ||||
| CVE-2026-80181 | 1 Apache | 1 Allura | 2026-09-08 | 9.1 Critical |
| Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. | ||||
| CVE-2026-80089 | 1 Microsoft | 8 365 Apps, Office 2016, Office 2019 and 5 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-80084 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-79904 | 2026-09-08 | 5 Medium | ||
| Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-79721 | 2026-09-08 | N/A | ||
| Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project. | ||||
| CVE-2026-79569 | 2026-09-08 | 9.8 Critical | ||
| Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement. | ||||
| CVE-2026-79426 | 1 Crmeb | 1 Crmeb | 2026-09-08 | 7.2 High |
| An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request. | ||||
| CVE-2026-79376 | 1 Bestechnic | 1 Bes2300 | 2026-09-08 | 8.8 High |
| An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet. | ||||