Export limit exceeded: 403252 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 403252 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 403252 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (717 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-1878 | 1 Asus | 2 Driver Headset , Driver Keyboard Mouse | 2026-09-17 | N/A |
| An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the "Security Update for ASUS ROG peripheral driver" section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-69832 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-16 | 5.6 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-81052 | 1 Dell | 40 Latitude 3330, Latitude 3420, Latitude 3440 and 37 more | 2026-09-16 | 6.8 Medium |
| Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution. | ||||
| CVE-2026-16072 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-09-16 | 4.9 Medium |
| A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization. | ||||
| CVE-2026-61911 | 2 Cyrus, Cyrusimap | 2 Imap, Cyrus Imap | 2026-09-16 | 4.3 Medium |
| An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery. | ||||
| CVE-2026-71330 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-16 | 7.5 High |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-68842 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-16 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69723 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-15 | 5.7 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-63310 | 1 Nltk | 1 Nltk | 2026-09-15 | 7.1 High |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-69406 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-14 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-38058 | 1 St Engineering Idirect | 3 3315-series Terminals, 9-series Terminals, Evolution Iq‑series Terminals | 2026-09-13 | 8.1 High |
| The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware. | ||||
| CVE-2026-79963 | 1 Dell | 3 Secure Connect Gateway, Secure Connect Gateway Appliance, Secure Connect Gateway Application | 2026-09-13 | 7.4 High |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution. | ||||
| CVE-2026-81394 | 1 Microsoft | 21 365, 365 Apps, Excel and 18 more | 2026-09-12 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-84195 | 1 Kyverno | 1 Kyverno | 2026-09-10 | 7.7 High |
| Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources. | ||||
| CVE-2026-81387 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 5.5 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-76968 | 1 Sap | 3 Content Server, Internet Communication Manager, Web Dispatcher | 2026-09-08 | 6.5 Medium |
| SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed information could potentially be used to facilitate further attacks. This vulnerability has a high impact on the confidentiality of the application, with no impact on integrity or availability. | ||||
| CVE-2026-62654 | 1 Siemens | 1 Reyrolle 7sr5 | 2026-09-08 | 6.8 Medium |
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code. | ||||
| CVE-2026-87063 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in konflux-operator-tasks. The Continuous Integration (CI) process installs the `tkn` command-line interface (CLI) from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to substitute a malicious binary, potentially leading to the execution of unauthorized code within the CI environment. | ||||
| CVE-2026-87059 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leading to a supply chain compromise where untrusted code is incorporated into software builds. | ||||
| CVE-2026-84666 | 1 Jenkins Project | 1 Jenkins Job Configuration History Plugin | 2026-09-05 | 5.4 Medium |
| Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings. | ||||