Export limit exceeded: 111024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (111024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58613 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-08-07 | 7.8 High |
| Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58619 | 1 Microsoft | 19 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 16 more | 2026-08-07 | 7 High |
| Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58626 | 1 Microsoft | 13 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 10 more | 2026-08-07 | 8.8 High |
| Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-58627 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-08-07 | 7.5 High |
| Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-58628 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-08-07 | 7.8 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58629 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-08-07 | 7 High |
| Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58632 | 1 Microsoft | 19 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 16 more | 2026-08-07 | 7.8 High |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58633 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-08-07 | 7.8 High |
| Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58634 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-08-07 | 7.8 High |
| Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58637 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 7 High |
| Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-56181 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-08-07 | 8.3 High |
| Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. | ||||
| CVE-2026-47301 | 1 Microsoft | 4 Configuration Manager, Configuration Manager 2503, Configuration Manager 2509 and 1 more | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-16540 | 2 Nsqua, Wordpress | 2 Simply Schedule Appointments, Wordpress | 2026-08-07 | 7.5 High |
| The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them. | ||||
| CVE-2026-56846 | 2 Nodejs, Redhat | 2 Nodejs, Hummingbird | 2026-08-07 | 7.5 High |
| A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**. | ||||
| CVE-2026-24079 | 1 Qualcomm | 287 Ar8035, Ar8035 Firmware, Csra6620 and 284 more | 2026-08-07 | 8.1 High |
| Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | ||||
| CVE-2026-15372 | 2 Wordpress, Wp2fac | 2 Wordpress, Wp2fac | 2026-08-07 | 7.5 High |
| The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts. | ||||
| CVE-2026-16443 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid 8 and 5 more | 2026-08-07 | 7.4 High |
| A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier. | ||||
| CVE-2026-17617 | 1 Ibm | 2 Application Gateway, Application Gateway Operator | 2026-08-07 | 8.5 High |
| IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources. | ||||
| CVE-2026-13153 | 2 Wordpress, Wpdevteam | 2 Wordpress, Gutenberg Essential Blocks | 2026-08-07 | 7.5 High |
| The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product. | ||||
| CVE-2026-13154 | 2 Wordpress, Wpdevteam | 2 Wordpress, Gutenberg Essential Blocks | 2026-08-07 | 7.5 High |
| The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public. | ||||