Export limit exceeded: 389647 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 389647 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 389647 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389647 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81393 | 1 Microsoft | 14 365 Apps, Excel, Excel 2016 and 11 more | 2026-09-10 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-12745 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 9.8 Critical |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12651 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 8.8 High |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12648 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 8.8 High |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12645 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 9.9 Critical |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12647 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 9.9 Critical |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-78512 | 1 Microsoft | 12 365 Apps, Microsoft 365, Microsoft Office Ltsc For Mac 2021 and 9 more | 2026-09-10 | 8.8 High |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-19583 | 2026-09-10 | 9.9 Critical | ||
| Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell). | ||||
| CVE-2026-87870 | 2026-09-10 | 6.4 Medium | ||
| The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities. | ||||
| CVE-2026-28659 | 2026-09-10 | N/A | ||
| In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-79324 | 2026-09-10 | 7.5 High | ||
| Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced. | ||||
| CVE-2026-77482 | 1 Microsoft | 6 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 3 more | 2026-09-10 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69734 | 1 Microsoft | 12 365, 365 Apps, Microsoft 365 and 9 more | 2026-09-10 | 6.5 Medium |
| Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-18351 | 2026-09-10 | 9.8 Critical | ||
| The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. | ||||
| CVE-2026-79323 | 2026-09-10 | 7.5 High | ||
| Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql. | ||||
| CVE-2026-79322 | 2026-09-10 | 8.6 High | ||
| SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view. | ||||
| CVE-2026-21107 | 2026-09-10 | N/A | ||
| Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-17084 | 1 Python | 1 Cpython | 2026-09-10 | N/A |
| The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | ||||
| CVE-2026-78449 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-10 | 8.1 High |
| Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78442 | 1 Microsoft | 4 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Sql Server 2017 and 1 more | 2026-09-10 | 8.8 High |
| Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network. | ||||