Export limit exceeded: 408201 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408201 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408201 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56826 | 2026-10-13 | 5.4 Medium | ||
| Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2. | ||||
| CVE-2026-102233 | 1 Microsoft | 1 Visual Studio Code | 2026-10-13 | 7.8 High |
| Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-102232 | 1 Microsoft | 1 Visual Studio Code | 2026-10-13 | 7 High |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-102231 | 1 Microsoft | 1 Visual Studio Code | 2026-10-13 | 7.7 High |
| Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-102229 | 1 Microsoft | 1 Visual Studio Code | 2026-10-13 | 6.8 Medium |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-102227 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-13 | 7.8 High |
| Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. | ||||
| CVE-2026-104875 | 2026-10-13 | 7.1 High | ||
| Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09. | ||||
| CVE-2026-110111 | 1 Xen-orchestra | 1 Xen Orchestra Server | 2026-10-13 | 7.5 High |
| Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution. | ||||
| CVE-2026-104584 | 2026-10-13 | N/A | ||
| reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions). | ||||
| CVE-2026-97801 | 1 Microsoft | 2 .net, .net Framework | 2026-10-13 | 7.5 High |
| Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-97819 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 6.5 Medium |
| Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97817 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 6.5 Medium |
| Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97816 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-13 | 9.8 Critical |
| Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97815 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97814 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-97813 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-10-13 | 6.5 Medium |
| Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-97805 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 12 more | 2026-10-13 | 9.8 Critical |
| Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96113 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-13 | 9.8 Critical |
| Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96303 | 1 Microsoft | 1 Powershell | 2026-10-13 | 6.5 Medium |
| Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-96940 | 1 Microsoft | 7 Exchange Server 2016, Exchange Server 2019, Exchange Server Se and 4 more | 2026-10-13 | 8.8 High |
| Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | ||||