Export limit exceeded: 376635 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 376635 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376635 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-43606 | 1 Amd | 2 Vitis Libraries, Vitis Unified Installer | 2026-08-13 | N/A |
| Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys. | ||||
| CVE-2025-0041 | 1 Amd | 1 Vitis Embedded Single File Download | 2026-08-13 | N/A |
| Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution. | ||||
| CVE-2025-61970 | 1 Amd | 1 Vitis Embedded Single File Download | 2026-08-13 | N/A |
| Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking. | ||||
| CVE-2025-48506 | 1 Amd | 1 Vitis Unified Installer | 2026-08-13 | N/A |
| Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution. | ||||
| CVE-2025-48505 | 1 Amd | 1 Vitis Unified Installer | 2026-08-13 | N/A |
| Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution. | ||||
| CVE-2026-64906 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64914 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64920 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64919 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-8087 | 1 Amd | 1 Amd Power Design Manager (pdm) Software Un-installer | 2026-08-13 | N/A |
| A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution. | ||||
| CVE-2025-0046 | 1 Amd | 1 Amd Power Design Manager (pdm) Software Installer For Windows | 2026-08-13 | N/A |
| Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution. | ||||
| CVE-2016-20097 | 1 Weaver | 1 E-cology 8.0 | 2026-08-13 | 7.5 High |
| Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC). | ||||
| CVE-2022-50997 | 1 Weaver | 2 E-cology 8.0, E-cology 9.0 | 2026-08-13 | 7.5 High |
| Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data from the Microsoft SQL Server backend. This vulnerability is potentially remediated in software version 10.53 or 10.54. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC). | ||||
| CVE-2026-48771 | 1 Ishankjha740 | 1 Ishankportfolio | 2026-08-13 | 8.2 High |
| ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive database rules may allow unauthorised users to read, modify, or abuse stored form submission data. This could impact personally identifiable information (PII) submitted through the website contact form, including names, email addresses, phone numbers, and messages. The issue has been patched in version 1.0.1. Users unable to upgrade immediately can reduce risk by disabling public read/write database access, rotating exposed API keys, restricting database policies to authenticated requests only, moving sensitive operations to secure backend/serverless functions, and/or monitoring database activity logs for suspicious access. | ||||
| CVE-2026-48790 | 1 Tursodatabase | 1 Turso-cli | 2026-08-13 | 5.5 Medium |
| Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Version 1.0.26 patches the issue. | ||||
| CVE-2026-47940 | 1 Adobe | 1 Lightroom Classic | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48410 | 1 Adobe | 1 Lightroom Classic | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48404 | 1 Adobe | 1 Lightroom Classic | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48407 | 1 Adobe | 1 Lightroom Classic | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48397 | 1 Adobe | 1 Lightroom Classic | 2026-08-13 | 8.6 High |
| Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||