110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,601–12,650 of 110,684 · page 253 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81396 | CVE-2026-81396 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81395 | CVE-2026-81395 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81394 | CVE-2026-81394 CVSS 5.5microsoft | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
| CVE-2026-81393 | CVE-2026-81393 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81392 | CVE-2026-81392 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81391 | CVE-2026-81391 CVSS 5.5microsoft | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-81390 | CVE-2026-81390 CVSS 5.5microsoft | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| CVE-2026-8139 | CVE-2026-8139 CVSS 5.4concretecms | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Conc… |
| CVE-2026-81389 | CVE-2026-81389 CVSS 7.0microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81388 | CVE-2026-81388 CVSS 7.8microsoft | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81387 | CVE-2026-81387 CVSS 5.5microsoft | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
| CVE-2026-81386 | CVE-2026-81386 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| CVE-2026-81385 | CVE-2026-81385 CVSS 8.8microsoft | Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. |
| CVE-2026-81383 | CVE-2026-81383 CVSS 7.4microsoft | Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81381 | CVE-2026-81381 CVSS 6.5microsoft | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-81380 | CVE-2026-81380 CVSS 5.3microsoft | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
| CVE-2026-8138 | CVE-2026-8138 CVSS 8.8 | A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg”. The manipulation… |
| CVE-2026-81379 | CVE-2026-81379 CVSS 8.2microsoft | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81378 | CVE-2026-81378 CVSS 8.2microsoft | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81377 | CVE-2026-81377 CVSS 6.5microsoft | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over … |
| CVE-2026-81376 | CVE-2026-81376 CVSS 9.6microsoft | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81375 | CVE-2026-81375 | A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows… |
| CVE-2026-8137 | CVE-2026-8137 CVSS 8.8 | A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerability affects the function sub_458E40 of the file /boafrm/formDdns. The m… |
| CVE-2026-81357 | CVE-2026-81357 CVSS 8.2microsoft | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-81356 | CVE-2026-81356 CVSS 8.2microsoft | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security fea… |
| CVE-2026-81355 | CVE-2026-81355 CVSS 7.5microsoft | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. |
| CVE-2026-81354 | CVE-2026-81354 CVSS 8.2microsoft | Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally. |
| CVE-2026-81353 | CVE-2026-81353 CVSS 7.8microsoft | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. |
| CVE-2026-81352 | CVE-2026-81352 CVSS 8.8microsoft | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
| CVE-2026-8135 | CVE-2026-8135 CVSS 7.2concretecms | Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rog… |
| CVE-2026-81349 | CVE-2026-81349 CVSS 7.2microsoft | Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privile… |
| CVE-2026-81348 | CVE-2026-81348 CVSS 3.7 | The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing … |
| CVE-2026-81347 | CVE-2026-81347 CVSS 5.9 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it,… |
| CVE-2026-81346 | CVE-2026-81346 CVSS 4.3 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated use… |
| CVE-2026-81344 | CVE-2026-81344 CVSS 6.6 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post … |
| CVE-2026-81343 | CVE-2026-81343 CVSS 5.3 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing … |
| CVE-2026-81342 | CVE-2026-81342 CVSS 4.7 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, … |
| CVE-2026-81341 | CVE-2026-81341 CVSS 6.5wolfssl | wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number car… |
| CVE-2026-81340 | CVE-2026-81340 CVSS 3.8 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through it… |
| CVE-2026-8134 | CVE-2026-8134 CVSS 7.2concretecms | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
| CVE-2026-81339 | CVE-2026-81339 CVSS 4.3 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowi… |
| CVE-2026-81338 | CVE-2026-81338 CVSS 4.6 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it a… |
| CVE-2026-81335 | CVE-2026-81335 CVSS 7.5 | Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/b… |
| CVE-2026-81334 | CVE-2026-81334 CVSS 6.1 | darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-… |
| CVE-2026-81330 | CVE-2026-81330 CVSS 6.5 | The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, a… |
| CVE-2026-81326 | CVE-2026-81326 CVSS 5.5 | QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to … |
| CVE-2026-81322 | CVE-2026-81322 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash r… |
| CVE-2026-81321 | CVE-2026-81321 CVSS 9.8 | CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through ph… |
| CVE-2026-81320 | CVE-2026-81320 CVSS 5.5 | A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object… |
| CVE-2026-81319 | CVE-2026-81319 | Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEA… |