Export limit exceeded: 389560 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389560 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75170 | 1 Hubcore | 1 Hubcore | 2026-09-09 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter. | ||||
| CVE-2026-75166 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-09 | 8.8 High |
| Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution. | ||||
| CVE-2026-75162 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-09 | 6.5 Medium |
| An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response. | ||||
| CVE-2026-71625 | 1 Slimkit | 1 Thinksns+ | 2026-09-09 | 9.8 Critical |
| An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component | ||||
| CVE-2026-71622 | 2026-09-09 | 7.4 High | ||
| SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component | ||||
| CVE-2026-67403 | 2026-09-09 | N/A | ||
| Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier. | ||||
| CVE-2026-70582 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-09 | 6.4 Medium |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69819 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-09 | 9.8 Critical |
| Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69790 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-09 | 7.8 High |
| Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69782 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-09 | 8.1 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69775 | 1 Microsoft | 2 Windows 11 23h2, Windows Server 2025 | 2026-09-09 | 7.1 High |
| Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69730 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-09 | 9.8 Critical |
| Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69711 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-09 | 7 High |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69582 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-09 | 7.8 High |
| Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69551 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-09 | 8.8 High |
| Use after free in Windows DNS allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-69531 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-09 | 5.5 Medium |
| Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-69429 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-09 | 7.5 High |
| Heap-based buffer overflow in Windows IKE Extension allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-69418 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-09 | 8 High |
| Heap-based buffer overflow in Volume Manager Driver allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69412 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-09 | 8 High |
| Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-69389 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-09 | 7.8 High |
| Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally. | ||||