Export limit exceeded: 408714 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408714 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-83674 | 1 Microsoft | 6 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 3 more | 2026-10-14 | 8.1 High |
| Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-83511 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 R2 and 4 more | 2026-10-14 | 7.4 High |
| Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-70075 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-14 | 4.4 Medium |
| Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-105010 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-14 | 9.8 Critical |
| Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-105003 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-14 | 7.8 High |
| Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103847 | 2026-10-14 | 8.6 High | ||
| Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed. | ||||
| CVE-2026-103553 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-14 | 7.8 High |
| Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102869 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-14 | 8.8 High |
| Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-110112 | 1 Finsys | 1 Dockhand | 2026-10-14 | 8.1 High |
| Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators. | ||||
| CVE-2026-110256 | 1 Finsys | 1 Dockhand | 2026-10-14 | 3.7 Low |
| Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting. | ||||
| CVE-2026-100193 | 2026-10-14 | 4.7 Medium | ||
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink. | ||||
| CVE-2026-96661 | 2026-10-14 | 7.5 High | ||
| The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability. | ||||
| CVE-2026-92705 | 1 Typesettingtools | 1 Aegisub | 2026-10-14 | 7.8 High |
| Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0. | ||||
| CVE-2026-108708 | 1 Wukongopensource | 1 Wukong Hrm | 2026-10-14 | 8.8 High |
| Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide. | ||||
| CVE-2026-108703 | 2 1panel-dev, Fit2cloud | 2 Cordyscrm, Cordys Crm | 2026-10-14 | 5.4 Medium |
| CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details. | ||||
| CVE-2026-108695 | 2 Multivendorx, Wordpress-extensions | 2 Multivendorx, Multivendorx | 2026-10-14 | 7.1 High |
| MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings. | ||||
| CVE-2026-108690 | 1 Gz-yami | 1 Mall4j | 2026-10-14 | 4.3 Medium |
| mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers. | ||||
| CVE-2026-108678 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-14 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts. | ||||
| CVE-2026-108673 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-14 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt content, model ids, and parameters, as an Excel workbook. | ||||
| CVE-2026-108668 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-14 | 5.4 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users. | ||||