Export limit exceeded: 376250 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376250 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61353 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7.8 High |
| Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-61346 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-08-11 | 7 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-61345 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 6.5 Medium |
| Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-59134 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7.5 High |
| Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-59135 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 5.5 Medium |
| Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-59130 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-08-11 | 5.6 Medium |
| No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-59128 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 5.5 Medium |
| Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-59124 | 1 Microsoft | 1 Windows App Client For Windows Desktop | 2026-08-11 | 9.8 Critical |
| Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-47285 | 1 Microsoft | 1 Visual Studio Code | 2026-08-11 | 6.5 Medium |
| Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-47299 | 1 Microsoft | 1 Azure Monitor Agent Linux Extension | 2026-08-11 | 7.2 High |
| Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-59113 | 1 Microsoft | 1 Visual Studio Code | 2026-08-11 | 8.8 High |
| Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-54984 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7.8 High |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-54113 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-08-11 | 7.5 High |
| Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-65768 | 1 Microsoft | 1 Teams | 2026-08-11 | 8.8 High |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-58650 | 1 Microsoft | 1 Visual Studio Code | 2026-08-11 | 7.8 High |
| Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-50472 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 7 High |
| Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-48506 | 2026-08-11 | N/A | ||
| Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution. | ||||
| CVE-2026-72535 | 1 Chaskiq | 1 Chaskiq | 2026-08-11 | 8.2 High |
| A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials. | ||||
| CVE-2026-72536 | 1 Chaskiq | 1 Chaskiq | 2026-08-11 | 8.2 High |
| A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials. | ||||
| CVE-2026-72607 | 1 Koha-community | 1 Koha | 2026-08-11 | 7.1 High |
| A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes. | ||||