Export limit exceeded: 388875 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (388875 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19683 | 2 Tp-link, Tp-link Systems Inc | 55 Dr3150, Dr3150 Firmware, Dr3150 V1 and 52 more | 2026-09-08 | 7.4 High |
| A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment. | ||||
| CVE-2026-78742 | 2026-09-08 | N/A | ||
| Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction. | ||||
| CVE-2026-80090 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69316 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-08 | 4.7 Medium |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69344 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69353 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-81952 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78741 | 2026-09-08 | N/A | ||
| Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature. | ||||
| CVE-2026-83949 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-09-08 | 5.5 Medium |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-83951 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-09-08 | 5.5 Medium |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-78738 | 2026-09-08 | N/A | ||
| Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature. | ||||
| CVE-2026-78510 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-09-08 | 9.8 Critical |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-9033 | 1 Tp-link | 55 Dr3150, Dr3150 Firmware, Dr3150 V1 and 52 more | 2026-09-08 | 4.3 Medium |
| An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate. | ||||
| CVE-2026-78507 | 1 Microsoft | 8 365 Apps, Microsoft 365, Office 2019 and 5 more | 2026-09-08 | 8.8 High |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78506 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 5.5 Medium |
| Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-78504 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-78503 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-84937 | 2 Video Player For Youtube Project, Wordpress | 2 Video Player For Youtube, Wordpress | 2026-09-08 | 6.8 Medium |
| The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database. | ||||
| CVE-2026-18406 | 2 Brainstormforce, Wordpress | 2 Sureforms, Wordpress | 2026-09-08 | 7.2 High |
| The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-85414 | 2 Fooplugins, Wordpress | 2 Gallery By Foogallery, Wordpress | 2026-09-08 | 6.4 Medium |
| The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||