Export limit exceeded: 389504 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 389504 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389504 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76967 | 1 Sap | 1 Netweaver Business Client | 2026-09-08 | 7.8 High |
| SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application. | ||||
| CVE-2026-76971 | 1 Sap | 1 Manufacturing Integration And Intelligence | 2026-09-08 | 6.5 Medium |
| Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of scripts. Successful exploitation could result in a low impact on the confidentiality, integrity, and availability of the application. | ||||
| CVE-2026-81802 | 2 Magepeopleteam, Wordpress | 2 Wpevently, Wordpress | 2026-09-08 | 6.5 Medium |
| Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions. | ||||
| CVE-2026-50093 | 1 Siemens | 2 Siveillance Control, Siveillance Control Pro | 2026-09-08 | 9 Critical |
| A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment. | ||||
| CVE-2026-86712 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-09-08 | 8.8 High |
| SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process. | ||||
| CVE-2026-80219 | 1 Redhat | 2 Apache Camel Hawtio, Build Of Apache Camel - Hawtio | 2026-09-08 | 8.7 High |
| A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt. | ||||
| CVE-2026-77091 | 1 Commvault | 1 Commvault | 2026-09-08 | N/A |
| DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store. | ||||
| CVE-2026-77092 | 1 Commvault | 1 Commvault | 2026-09-08 | N/A |
| Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor. | ||||
| CVE-2026-77097 | 1 Commvault | 1 Commvault | 2026-09-08 | N/A |
| Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server. | ||||
| CVE-2026-77098 | 1 Commvault | 1 Commvault | 2026-09-08 | N/A |
| Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server. | ||||
| CVE-2026-77106 | 1 Commvault | 1 Commvault | 2026-09-08 | N/A |
| Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X. | ||||
| CVE-2026-33197 | 1 Ami | 1 Aptio V | 2026-09-08 | N/A |
| AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability. | ||||
| CVE-2026-0001 | 1 Arm | 3 Arm 5th Gen Gpu Architecture Kernel Driver, Bifrost Gpu Kernel Driver, Valhall Gpu Kernel Driver | 2026-09-08 | 4.4 Medium |
| Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0. | ||||
| CVE-2026-67380 | 1 Microsoft | 8 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr) and 5 more | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-69722 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-86819 | 2026-09-08 | 7.1 High | ||
| Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0. | ||||
| CVE-2026-69719 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 6.5 Medium |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-77827 | 2026-09-08 | 7.1 High | ||
| Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'. Fixed in 4.0.80. | ||||
| CVE-2026-66774 | 2 Sap, Sap Se | 2 Approuter, Sap Business Ai Platform (approuter) | 2026-09-08 | 3.7 Low |
| SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity. | ||||
| CVE-2026-66760 | 2 Sap, Sap Se | 2 Approuter, Sap Business Ai Platform (approuter) | 2026-09-08 | 6.4 Medium |
| SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability. | ||||