Export limit exceeded: 376678 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376678 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72602 | 1 Asyncfuncai | 1 Deepwiki-open | 2026-08-13 | 7.5 High |
| A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and returns a directory listing without authentication, as WIKI_AUTH_MODE defaults to false. An attacker can enumerate sensitive directory contents on the host system. | ||||
| CVE-2026-72606 | 1 Pinry | 1 Pinry | 2026-08-13 | 7.5 High |
| A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server. | ||||
| CVE-2026-69108 | 1 Siemens | 1 Siemens License Server (sls) | 2026-08-13 | 6 Medium |
| A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise. | ||||
| CVE-2026-69109 | 1 Siemens | 1 Siemens License Server (sls) | 2026-08-13 | 7.5 High |
| A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application. | ||||
| CVE-2026-17061 | 1 Dassault Systèmes | 1 Simulia Execution Engine | 2026-08-13 | 10 Critical |
| A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution. | ||||
| CVE-2026-6727 | 1 Trustedcomputinggroup | 1 Tpm2.0 | 2026-08-13 | 5.9 Medium |
| A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011. | ||||
| CVE-2026-6726 | 1 Trustedcomputinggroup | 1 Tpm2.0 | 2026-08-13 | 7.9 High |
| An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010. | ||||
| CVE-2025-31114 | 1 Lllyasviel | 1 Fooocus | 2026-08-13 | N/A |
| Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available. | ||||
| CVE-2026-67179 | 1 Genkit-ai | 1 Genkit | 2026-08-13 | 7.8 High |
| Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18. | ||||
| CVE-2026-67180 | 1 Google | 1 Turbinia | 2026-08-13 | 8.4 High |
| Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10. | ||||
| CVE-2026-43606 | 1 Amd | 2 Vitis Libraries, Vitis Unified Installer | 2026-08-13 | N/A |
| Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys. | ||||
| CVE-2025-0041 | 1 Amd | 1 Vitis Embedded Single File Download | 2026-08-13 | N/A |
| Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution. | ||||
| CVE-2025-61970 | 1 Amd | 1 Vitis Embedded Single File Download | 2026-08-13 | N/A |
| Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking. | ||||
| CVE-2025-48506 | 1 Amd | 1 Vitis Unified Installer | 2026-08-13 | N/A |
| Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution. | ||||
| CVE-2025-48505 | 1 Amd | 1 Vitis Unified Installer | 2026-08-13 | N/A |
| Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution. | ||||
| CVE-2026-64906 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64914 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64920 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64919 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-8087 | 1 Amd | 1 Amd Power Design Manager (pdm) Software Un-installer | 2026-08-13 | N/A |
| A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution. | ||||