Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
44,343 matching · page 201/887Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-59119(opens NVD record) | High | 7.3 | Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. | Aug 11, 2026 |
| CVE-2026-59113(opens NVD record) | High | 8.8 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | Aug 11, 2026 |
| CVE-2026-58651(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | Aug 11, 2026 |
| CVE-2026-58650(opens NVD record) | High | 7.8 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | Aug 11, 2026 |
| CVE-2026-58641(opens NVD record) | High | 7.8 | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. | Aug 11, 2026 |
| CVE-2026-58639(opens NVD record) | Medium | 6.5 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | Aug 11, 2026 |
| CVE-2026-58612(opens NVD record) | High | 7.4 | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. | Aug 11, 2026 |
| CVE-2026-57105(opens NVD record) | High | 8.0 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | Aug 11, 2026 |
| CVE-2026-57104(opens NVD record) | High | 8.8 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network. | Aug 11, 2026 |
| CVE-2026-56179(opens NVD record) | High | 8.3 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. | Aug 11, 2026 |
| CVE-2026-56174(opens NVD record) | High | 7.8 | Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | Aug 11, 2026 |
| CVE-2026-54984(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally. | Aug 11, 2026 |
| CVE-2026-54981(opens NVD record) | High | 7.8 | Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally. | Aug 11, 2026 |
| CVE-2026-54123(opens NVD record) | Medium | 5.5 | Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally. | Aug 11, 2026 |
| CVE-2026-54113(opens NVD record) | High | 7.5 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | Aug 11, 2026 |
| CVE-2026-50516(opens NVD record) | Critical | 9.4 | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | Aug 11, 2026 |
| CVE-2026-50472(opens NVD record) | High | 7.0 | Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally. | Aug 11, 2026 |
| CVE-2026-49179(opens NVD record) | High | 8.8 | Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network. | Aug 11, 2026 |
| CVE-2026-48483(opens NVD record) | Medium | 5.4 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue. | Aug 11, 2026 |
| CVE-2026-48446(opens NVD record) | Medium | 5.5 | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | Aug 11, 2026 |
| CVE-2026-48445(opens NVD record) | Medium | 6.2 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48444(opens NVD record) | Medium | 6.2 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48443(opens NVD record) | Medium | 6.2 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48442(opens NVD record) | High | 7.1 | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed. | Aug 11, 2026 |
| CVE-2026-48440(opens NVD record) | High | 8.1 | ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48439(opens NVD record) | High | 7.5 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48438(opens NVD record) | High | 7.5 | CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48437(opens NVD record) | Medium | 5.5 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | Aug 11, 2026 |
| CVE-2026-48436(opens NVD record) | Medium | 6.5 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | Aug 11, 2026 |
| CVE-2026-48435(opens NVD record) | Medium | 6.2 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48434(opens NVD record) | Medium | 6.2 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48387(opens NVD record) | Medium | 6.2 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48386(opens NVD record) | High | 7.5 | ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48385(opens NVD record) | High | 7.7 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed. | Aug 11, 2026 |
| CVE-2026-48384(opens NVD record) | Medium | 4.9 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48376(opens NVD record) | Medium | 5.4 | is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48375(opens NVD record) | Medium | 6.5 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | Aug 11, 2026 |
| CVE-2026-48362(opens NVD record) | Critical | 10.0 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | Aug 11, 2026 |
| CVE-2026-47922(opens NVD record) | Medium | 4.7 | CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | Aug 11, 2026 |
| CVE-2026-47704(opens NVD record) | Unscored | — | TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign live `resultId`. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant `result` only by `resultId`. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue. | Aug 11, 2026 |
| CVE-2026-47299(opens NVD record) | High | 7.2 | Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network. | Aug 11, 2026 |
| CVE-2026-47285(opens NVD record) | Medium | 6.5 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | Aug 11, 2026 |
| CVE-2026-43606(opens NVD record) | Unscored | — | Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys. | Aug 11, 2026 |
| CVE-2026-42976(opens NVD record) | High | 7.8 | Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally. | Aug 11, 2026 |
| CVE-2026-40375(opens NVD record) | Medium | 6.5 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | Aug 11, 2026 |
| CVE-2026-39452(opens NVD record) | Unscored | — | Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | Aug 11, 2026 |
| CVE-2026-35502(opens NVD record) | Unscored | — | Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | Aug 11, 2026 |
| CVE-2026-34635(opens NVD record) | High | 8.4 | is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed. | Aug 11, 2026 |
| CVE-2026-34175(opens NVD record) | Unscored | — | Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | Aug 11, 2026 |
| CVE-2026-32791(opens NVD record) | Unscored | — | Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | Aug 11, 2026 |