Export limit exceeded: 410190 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410190 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112003 | 1 Projectsend | 1 Projectsend | 2026-10-18 | 5.9 Medium |
| ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files. | ||||
| CVE-2026-112002 | 1 Projectsend | 1 Projectsend | 2026-10-18 | 6.8 Medium |
| ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account. | ||||
| CVE-2026-112001 | 1 Projectsend | 1 Projectsend | 2026-10-18 | 7.2 High |
| ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions. | ||||
| CVE-2026-70173 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83669 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-18 | 7.8 High |
| Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-84012 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-18 | 8.1 High |
| Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-84013 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83755 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 5.5 Medium |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83857 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83860 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.5 High |
| Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-74033 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-18 | 6.1 Medium |
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path, bypassing REST validation and RBAC to delete files like rbac.db. | ||||
| CVE-2026-83578 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 9.8 Critical |
| Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-83683 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 6.5 Medium |
| Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-84471 | 1 Openvpn | 1 Openvpn | 2026-10-18 | N/A |
| The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry. | ||||
| CVE-2026-107436 | 2026-10-18 | 8.8 High | ||
| Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12. | ||||
| CVE-2026-110373 | 2026-10-18 | 8.1 High | ||
| Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77. | ||||
| CVE-2026-110880 | 2026-10-18 | 6.5 Medium | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6. | ||||
| CVE-2026-110886 | 2026-10-18 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1. | ||||
| CVE-2026-109894 | 2026-10-18 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29. | ||||
| CVE-2026-110883 | 2026-10-18 | 6.5 Medium | ||
| Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5. | ||||