Export limit exceeded: 385751 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (1257 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82670 | 1 Iobit | 1 Uninstaller | 2026-08-31 | 4.4 Medium |
| A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82628 | 1 Colorful | 1 Igamecenter | 2026-08-31 | 8.8 High |
| A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement. | ||||
| CVE-2026-79276 | 1 Google | 1 Chrome | 2026-08-31 | 4.3 Medium |
| Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2025-10263 | 1 Arm | 20 C1-premium, C1-ultra, Cortex-a710 and 17 more | 2026-08-31 | 9.1 Critical |
| Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level. | ||||
| CVE-2026-78158 | 1 Open5gs | 1 Open5gs | 2026-08-27 | 6.3 Medium |
| A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. | ||||
| CVE-2026-15218 | 2 Red Hat, Redhat | 2 Red Hat Openshift Ai (rhoai), Openshift Ai | 2026-08-27 | 7.9 High |
| A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these excessive permissions. This could lead to full cluster administrator privileges through the creation of new ClusterRoleBindings or the disclosure of sensitive information by accessing all secrets across the cluster. | ||||
| CVE-2026-18621 | 2 Red Hat, Redhat | 3 Red Hat Openshift Ai (rhoai), Ai Inference Server, Openshift Ai | 2026-08-27 | 7.6 High |
| A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the underlying node. | ||||
| CVE-2026-15467 | 2 Red Hat, Redhat | 2 Red Hat Openshift Ai (rhoai), Openshift Ai | 2026-08-27 | 8.1 High |
| A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to arbitrary code execution within the cluster. | ||||
| CVE-2026-32566 | 2 Acpt, Wordpress | 2 Acpt (pro) - Custom Post Types Plugin For Wordpress, Wordpress | 2026-08-27 | 9.8 Critical |
| Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | ||||
| CVE-2026-78267 | 2 Cozmoslabs, Wordpress | 2 Translatepress, Wordpress | 2026-08-27 | 9.8 Critical |
| Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions. | ||||
| CVE-2026-78271 | 2026-08-27 | 7.2 High | ||
| Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions. | ||||
| CVE-2026-71468 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-27 | 5.3 Medium |
| A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure. | ||||
| CVE-2026-78115 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-08-26 | 5.4 Medium |
| A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-10059 | 1 Redhat | 2 Multicluster Engine, Multicluster Engine For Kubernetes | 2026-08-26 | 9.1 Critical |
| A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster. | ||||
| CVE-2026-75910 | 1 Aws | 1 Athena Federated Query Clickhouse Connector Deployment Template | 2026-08-25 | 6.5 Medium |
| Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint. To remediate this issue, users should upgrade to aws-athena-query-federation connectors version v2026.17.1 or later and ensure that any forked or derivative code is patched to incorporate the new fixes. Alternatively, to remediate this issue, users should redeploy the connector with the current template and supply a non-empty SecretNamePrefix value. | ||||
| CVE-2026-32561 | 2026-08-25 | 8.8 High | ||
| Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. | ||||
| CVE-2026-74985 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-25 | 9.8 Critical |
| Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-77036 | 1 Eladmin | 1 Eladmin | 2026-08-25 | 6.3 Medium |
| A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-32558 | 2 Redefiningtheweb, Wordpress | 2 Affiliate Pro - Affiliate Program For Woocommerce & Wordpress, Wordpress | 2026-08-24 | 9.8 Critical |
| Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions. | ||||
| CVE-2026-66648 | 2 Mvpthemes, Wordpress | 2 Jawn, Wordpress | 2026-08-24 | 9.8 Critical |
| Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions. | ||||