Export limit exceeded: 41104 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (41104 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58239 | 2 Sap, Sap Se | 2 Approuter, Sap Business Ai Platform (approuter) | 2026-09-08 | 3.7 Low |
| SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability. | ||||
| CVE-2026-81401 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-80083 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-08 | 8.8 High |
| Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally. | ||||
| CVE-2026-77889 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-08 | 7.5 High |
| Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-77499 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-08 | 7.5 High |
| Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-72956 | 1 Microsoft | 4 365 Apps, Office 2019, Office 2021 and 1 more | 2026-09-08 | 6.5 Medium |
| Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-70584 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-08 | 7.8 High |
| Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-70283 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-08 | 7 High |
| Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69501 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-08 | 7 High |
| Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-12646 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-08 | 9.9 Critical |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12647 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-08 | 9.9 Critical |
| A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-78635 | 2026-09-08 | 5 Medium | ||
| The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior. | ||||
| CVE-2026-78626 | 2026-09-08 | 8.1 High | ||
| The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources. | ||||
| CVE-2026-78623 | 2026-09-08 | 7.7 High | ||
| The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database. | ||||
| CVE-2026-19232 | 2026-09-08 | 9.9 Critical | ||
| Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2025-70152 | 2 Code-projects, Fabian | 2 Scholars Tracking System, Scholars Tracking System | 2026-09-08 | 9.8 Critical |
| code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization. | ||||
| CVE-2026-66820 | 1 Microsoft | 8 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr) and 5 more | 2026-09-08 | 8.8 High |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2025-70150 | 1 Codeastro | 1 Membership Management System | 2026-09-08 | 9.8 Critical |
| CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter. | ||||
| CVE-2025-70149 | 1 Codeastro | 1 Membership Management System | 2026-09-08 | 9.8 Critical |
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter. | ||||
| CVE-2025-70148 | 1 Codeastro | 1 Membership Management System | 2026-09-08 | 7.5 High |
| Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference (IDOR). | ||||