Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
31,416 matching · page 149/629Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-37176(opens NVD record) | Medium | 6.5 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism. | Jan 13, 2026 |
| CVE-2025-37175(opens NVD record) | High | 7.2 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37174(opens NVD record) | High | 7.2 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37173(opens NVD record) | High | 7.2 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system. | Jan 13, 2026 |
| CVE-2025-37172(opens NVD record) | High | 7.2 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37171(opens NVD record) | High | 7.2 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37170(opens NVD record) | High | 7.2 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37169(opens NVD record) | High | 7.2 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system. | Jan 13, 2026 |
| CVE-2025-37168(opens NVD record) | High | 8.2 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and potentially result in denial-of-service conditions on affected devices. | Jan 13, 2026 |
| CVE-2026-21304(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21288(opens NVD record) | Medium | 5.5 | Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21283(opens NVD record) | High | 7.8 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21281(opens NVD record) | High | 7.8 | InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21280(opens NVD record) | High | 8.6 | Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21278(opens NVD record) | Medium | 5.5 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21277(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21276(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21275(opens NVD record) | High | 7.8 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21274(opens NVD record) | High | 7.8 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Jan 13, 2026 |
| CVE-2026-21272(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21271(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21268(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21267(opens NVD record) | High | 8.6 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. | Jan 13, 2026 |
| CVE-2026-21226(opens NVD record) | High | 7.5 | Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. | Jan 13, 2026 |
| CVE-2026-21265(opens NVD record) | Medium | 6.4 | Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Windows Boot Manager 10/19/2026 For more information see this CVE and Windows Secure Boot certificate expiration and CA updates. | Jan 13, 2026 |
| CVE-2026-21224(opens NVD record) | High | 7.8 | Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-21221(opens NVD record) | High | 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-21219(opens NVD record) | High | 7.0 | Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20965(opens NVD record) | High | 7.5 | Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-20963(opens NVD record) | Critical | 9.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Jan 13, 2026 |
| CVE-2026-20962(opens NVD record) | Medium | 4.4 | Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally. | Jan 13, 2026 |
| CVE-2026-20959(opens NVD record) | Medium | 4.6 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | Jan 13, 2026 |
| CVE-2026-20958(opens NVD record) | Medium | 5.4 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Jan 13, 2026 |
| CVE-2026-20957(opens NVD record) | High | 7.8 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20956(opens NVD record) | High | 7.8 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20955(opens NVD record) | High | 7.8 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20953(opens NVD record) | High | 8.4 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20952(opens NVD record) | High | 8.4 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20951(opens NVD record) | High | 7.8 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20950(opens NVD record) | High | 7.8 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20949(opens NVD record) | High | 7.8 | Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. | Jan 13, 2026 |
| CVE-2026-20948(opens NVD record) | High | 7.8 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20947(opens NVD record) | High | 8.8 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Jan 13, 2026 |
| CVE-2026-20946(opens NVD record) | High | 7.8 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20944(opens NVD record) | High | 8.4 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20943(opens NVD record) | High | 7.0 | Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. | Jan 13, 2026 |
| CVE-2026-20941(opens NVD record) | High | 7.8 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-20940(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |
| CVE-2026-20939(opens NVD record) | Medium | 5.5 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | Jan 13, 2026 |
| CVE-2026-20938(opens NVD record) | High | 7.8 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | Jan 13, 2026 |