Export limit exceeded: 377195 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377195 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377195 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-50059 | 1 Siemens | 2 Solid Edge Se2025, Solid Edge Se2026 | 2026-08-12 | 7.8 High |
| A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2026-50061 | 1 Siemens | 2 Solid Edge Se2025, Solid Edge Se2026 | 2026-08-12 | 7.8 High |
| A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2026-50064 | 1 Siemens | 2 Solid Edge Se2025, Solid Edge Se2026 | 2026-08-12 | 7.8 High |
| A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2026-57263 | 1 Siemens | 1 Logo! Soft Comfort | 2026-08-12 | 6.8 Medium |
| A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash. | ||||
| CVE-2026-18639 | 1 Rapid7 | 1 Velociraptor | 2026-08-12 | 7.3 High |
| When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover. | ||||
| CVE-2026-66799 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7.8 High |
| Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-53412 | 2 Zoom, Zoom Communications | 3 Workplace Desktop, Workplace Virtual Desktop Infrastructure, Zoom Workplace | 2026-08-11 | 9.8 Critical |
| Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access. | ||||
| CVE-2026-62900 | 1 Microsoft | 3 .net, Visual Studio 2022, Visual Studio 2026 | 2026-08-11 | 5.9 Medium |
| Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-62764 | 1 Apache | 1 Accumulo | 2026-08-11 | 6.5 Medium |
| Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components (compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), leading to a denial of service. This issue affects Apache Accumulo 2.1.4 and 2.1.5. Users are recommended to upgrade to version 2.1.6, which fixes the issue. | ||||
| CVE-2025-60357 | 1 Ahnlab | 1 Epp Management | 2026-08-11 | 8.1 High |
| AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint. | ||||
| CVE-2026-59701 | 1 Siemens | 1 Simcenter Femap | 2026-08-11 | 7.8 High |
| A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2026-48056 | 1 Truelockmc | 1 Streambert | 2026-08-11 | 10 Critical |
| Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch. | ||||
| CVE-2026-18636 | 1 Rapid7 | 1 Velociraptor | 2026-08-11 | 6.8 Medium |
| The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission. | ||||
| CVE-2026-51080 | 1 Proxmox | 2 Libpve-storage-perl, Libpvestorage-perl | 2026-08-11 | 9.8 Critical |
| libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. | ||||
| CVE-2026-14238 | 2 Vitepos, Wordpress | 2 Vitepos, Wordpress | 2026-08-11 | 4.1 Medium |
| The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection. | ||||
| CVE-2026-47702 | 1 Baptistearno | 1 Typebot.io | 2026-08-11 | N/A |
| TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue. | ||||
| CVE-2026-18127 | 1 Ivanti | 1 Endpoint Manager | 2026-08-11 | 7.7 High |
| External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage. | ||||
| CVE-2026-50063 | 1 Siemens | 2 Solid Edge Se2025, Solid Edge Se2026 | 2026-08-11 | 7.8 High |
| A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. | ||||
| CVE-2026-18125 | 1 Ivanti | 1 Endpoint Manager | 2026-08-11 | 7.5 High |
| An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service. | ||||
| CVE-2026-72920 | 1 Seaweedfs | 1 Seaweedfs | 2026-08-11 | 9.8 Critical |
| SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and related IAM RPCs to mint credentials and gain S3 administrative control. This issue is fixed in versions 4.24. | ||||