Export limit exceeded: 377202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377202 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72606 | 1 Pinry | 1 Pinry | 2026-08-13 | 7.5 High |
| A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server. | ||||
| CVE-2026-69108 | 1 Siemens | 1 Siemens License Server (sls) | 2026-08-13 | 6 Medium |
| A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise. | ||||
| CVE-2026-69109 | 1 Siemens | 1 Siemens License Server (sls) | 2026-08-13 | 7.5 High |
| A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application. | ||||
| CVE-2026-17061 | 1 Dassault Systèmes | 1 Simulia Execution Engine | 2026-08-13 | 10 Critical |
| A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution. | ||||
| CVE-2026-6727 | 1 Trustedcomputinggroup | 1 Tpm2.0 | 2026-08-13 | 5.9 Medium |
| A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011. | ||||
| CVE-2026-6726 | 1 Trustedcomputinggroup | 1 Tpm2.0 | 2026-08-13 | 7.9 High |
| An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010. | ||||
| CVE-2026-67179 | 1 Genkit-ai | 1 Genkit | 2026-08-13 | 7.8 High |
| Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18. | ||||
| CVE-2026-67180 | 1 Google | 1 Turbinia | 2026-08-13 | 8.4 High |
| Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10. | ||||
| CVE-2026-43606 | 1 Amd | 2 Vitis Libraries, Vitis Unified Installer | 2026-08-13 | N/A |
| Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys. | ||||
| CVE-2025-0041 | 1 Amd | 1 Vitis Embedded Single File Download | 2026-08-13 | N/A |
| Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution. | ||||
| CVE-2025-61970 | 1 Amd | 1 Vitis Embedded Single File Download | 2026-08-13 | N/A |
| Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking. | ||||
| CVE-2025-48506 | 1 Amd | 1 Vitis Unified Installer | 2026-08-13 | N/A |
| Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution. | ||||
| CVE-2025-48505 | 1 Amd | 1 Vitis Unified Installer | 2026-08-13 | N/A |
| Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution. | ||||
| CVE-2026-64906 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64914 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64920 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-64919 | 1 Microsoft | 6 365 Apps, Access 2016, Microsoft Access 2016 (32-bit Edition) and 3 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-8087 | 1 Amd | 1 Amd Power Design Manager (pdm) Software Un-installer | 2026-08-13 | N/A |
| A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution. | ||||
| CVE-2025-0046 | 1 Amd | 1 Amd Power Design Manager (pdm) Software Installer For Windows | 2026-08-13 | N/A |
| Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution. | ||||
| CVE-2016-20097 | 1 Weaver | 1 E-cology 8.0 | 2026-08-13 | 7.5 High |
| Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files containing database credentials. Disclosure materials indicate that this vulnerability has been remediated, but it's unclear which version resolved the issue. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC). | ||||