Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
31,068 matching · page 141/622Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-37181(opens NVD record) | High | 7.2 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation. | Jan 14, 2026 |
| CVE-2025-67399(opens NVD record) | Medium | 4.6 | An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-Fi and BLE module) on the device is open to access | Jan 14, 2026 |
| CVE-2025-68970(opens NVD record) | Medium | 6.1 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jan 14, 2026 |
| CVE-2025-68969(opens NVD record) | Medium | 6.8 | Multi-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68968(opens NVD record) | High | 7.8 | Double free vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect the input function. | Jan 14, 2026 |
| CVE-2025-68967(opens NVD record) | Medium | 5.7 | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jan 14, 2026 |
| CVE-2025-68966(opens NVD record) | Medium | 5.1 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jan 14, 2026 |
| CVE-2025-68965(opens NVD record) | Medium | 4.7 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jan 14, 2026 |
| CVE-2025-68964(opens NVD record) | Medium | 6.2 | Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68963(opens NVD record) | Medium | 5.7 | Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jan 14, 2026 |
| CVE-2025-68962(opens NVD record) | Medium | 5.1 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68961(opens NVD record) | Medium | 5.1 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68960(opens NVD record) | High | 8.4 | Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68959(opens NVD record) | Medium | 6.2 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jan 14, 2026 |
| CVE-2025-68958(opens NVD record) | High | 8.0 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68957(opens NVD record) | High | 8.4 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68956(opens NVD record) | High | 8.0 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2025-68955(opens NVD record) | High | 8.0 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. | Jan 14, 2026 |
| CVE-2026-21287(opens NVD record) | High | 7.8 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2025-37179(opens NVD record) | Medium | 5.3 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process. | Jan 13, 2026 |
| CVE-2025-37178(opens NVD record) | Medium | 5.3 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process. | Jan 13, 2026 |
| CVE-2025-37177(opens NVD record) | Medium | 6.5 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system. | Jan 13, 2026 |
| CVE-2025-37176(opens NVD record) | Medium | 6.5 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism. | Jan 13, 2026 |
| CVE-2025-37175(opens NVD record) | High | 7.2 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37174(opens NVD record) | High | 7.2 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37173(opens NVD record) | High | 7.2 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system. | Jan 13, 2026 |
| CVE-2025-37172(opens NVD record) | High | 7.2 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37171(opens NVD record) | High | 7.2 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37170(opens NVD record) | High | 7.2 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37169(opens NVD record) | High | 7.2 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37168(opens NVD record) | High | 8.2 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and potentially result in denial-of-service conditions on affected devices. | Jan 13, 2026 |
| CVE-2026-21304(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21288(opens NVD record) | Medium | 5.5 | Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21283(opens NVD record) | High | 7.8 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21281(opens NVD record) | High | 7.8 | InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21280(opens NVD record) | High | 8.6 | Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21278(opens NVD record) | Medium | 5.5 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21277(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21276(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21275(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21274(opens NVD record) | High | 7.8 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21272(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21271(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21268(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21267(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21226(opens NVD record) | High | 7.5 | Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. | Jan 13, 2026 |
| CVE-2026-21265(opens NVD record) | Medium | 6.4 | Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Windows Boot Manager 10/19/2026 For more information see this CVE and Windows Secure Boot certificate expiration and CA updates. | Jan 13, 2026 |
| CVE-2026-21224(opens NVD record) | High | 7.8 | Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-21221(opens NVD record) | High | 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-21219(opens NVD record) | High | 7.0 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |