Export limit exceeded: 377195 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377195 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377195 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377195 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58431 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Public-only API token restriction is not enforced on team API routes | ||||
| CVE-2026-58432 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | ||||
| CVE-2026-58433 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | ||||
| CVE-2026-58435 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Gitea LFS Deploy-Key Privilege Escalation | ||||
| CVE-2026-58436 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | ||||
| CVE-2026-58438 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | ||||
| CVE-2026-58440 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) | ||||
| CVE-2026-58441 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | ||||
| CVE-2026-58508 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | ||||
| CVE-2026-19745 | 1 Calix | 1 Gigaspire | 2026-08-13 | 4.3 Medium |
| A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-73669 | 2026-08-13 | 6.3 Medium | ||
| The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights. | ||||
| CVE-2026-62888 | 1 Microsoft | 14 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 11 more | 2026-08-13 | 7.8 High |
| Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62889 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 8.1 High |
| Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62892 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-08-13 | 7 High |
| Use after free in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62894 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62911 | 1 Microsoft | 5 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 2 more | 2026-08-13 | 8 High |
| Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62912 | 1 Microsoft | 6 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 3 more | 2026-08-13 | 6.5 Medium |
| Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-62914 | 1 Microsoft | 5 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 2 more | 2026-08-13 | 7.3 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-63517 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-08-13 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-63519 | 1 Microsoft | 13 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 10 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||