Export limit exceeded: 376110 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376110 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73229 | 2026-08-11 | 4.3 Medium | ||
| Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2. | ||||
| CVE-2026-73226 | 2026-08-11 | 8.8 High | ||
| electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186. | ||||
| CVE-2026-73221 | 2026-08-11 | N/A | ||
| CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0. | ||||
| CVE-2026-72971 | 1 Microsoft | 1 Windows 11 26h1 | 2026-08-11 | 5.5 Medium |
| Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-72898 | 1 Metabase | 1 Metabase | 2026-08-11 | 10 Critical |
| Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. | ||||
| CVE-2026-70347 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7.8 High |
| Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70329 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-08-11 | 8.8 High |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70324 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-11 | 8.8 High |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70319 | 1 Microsoft | 7 365 Apps, Office 2019, Office 2021 and 4 more | 2026-08-11 | 5.5 Medium |
| Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-70314 | 1 Microsoft | 7 365 Apps, Office 2019, Office 2021 and 4 more | 2026-08-11 | 5.5 Medium |
| Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-70307 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7 High |
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69306 | 1 Microsoft | 1 Visual Studio Code | 2026-08-11 | 8.2 High |
| Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-69115 | 2026-08-11 | 6.5 Medium | ||
| OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts. | ||||
| CVE-2026-68820 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7 High |
| Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68807 | 1 Microsoft | 8 365 Apps, Excel 2016, Office 2019 and 5 more | 2026-08-11 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-68802 | 1 Microsoft | 8 365 Apps, Excel 2016, Office 2019 and 5 more | 2026-08-11 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-68793 | 1 Microsoft | 8 365 Apps, Excel 2016, Office 2019 and 5 more | 2026-08-11 | 7.8 High |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-66151 | 1 Sonicwall | 1 Global Vpn Client | 2026-08-11 | 5.5 Medium |
| SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash. | ||||
| CVE-2026-65811 | 1 Microsoft | 1 Power Bi Report Server | 2026-08-11 | 8.8 High |
| Improper input validation in Power BI allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-65786 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-08-11 | 7.8 High |
| Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||