Export limit exceeded: 388644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (388644 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66305 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 7.1 High |
| Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-63523 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 6.5 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-66308 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-66306 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 6.5 Medium |
| Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-66302 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 9.8 Critical |
| External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-66304 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 7.5 High |
| Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-86477 | 2026-09-08 | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||
| CVE-2026-9317 | 1 Nangohq | 1 Nango | 2026-09-08 | 8.1 High |
| Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process. | ||||
| CVE-2026-86667 | 1 Aircheng-org | 1 Iwebshop-5 | 2026-09-08 | 4.7 Medium |
| A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-86225 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-09-08 | 7.3 High |
| A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-86179 | 1 Code-projects | 1 Daily Expense Manager | 2026-09-08 | 5.3 Medium |
| A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp_ak.sql of the component Database Backup Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-86167 | 1 Tenda | 2 Hg10, Hg10 Firmware | 2026-09-08 | 9.9 Critical |
| A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | ||||
| CVE-2026-86100 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-09-08 | 6.4 Medium |
| Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services. | ||||
| CVE-2026-86095 | 1 Unidata | 1 Netcdf | 2026-09-08 | 7.8 High |
| Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names. | ||||
| CVE-2026-86091 | 1 Ntop | 1 Ntopng | 2026-09-08 | 7.1 High |
| ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies. | ||||
| CVE-2026-85880 | 1 Microsoft | 9 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 6 more | 2026-09-08 | 7.8 High |
| Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85701 | 1 Ramon-victor | 1 Freegpt-webui | 2026-09-08 | 5.3 Medium |
| A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-85636 | 1 Jofpin | 1 Trape | 2026-09-08 | 5.3 Medium |
| A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-84386 | 1 Fortinet | 1 Forticlientwindows | 2026-09-08 | 4.7 Medium |
| A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via <insert attack vector here> | ||||
| CVE-2026-82076 | 1 Mongodb | 1 Mongodb Server | 2026-09-08 | 6.5 Medium |
| An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node. | ||||