Export limit exceeded: 381923 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15059 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15059 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-57107 | 1 Microsoft | 1 Windows Admin Center | 2026-07-15 | 7.8 High |
| Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-54121 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-07-15 | 8.8 High |
| Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2020-37255 | 2 Wordpress, Wptimecapsule | 2 Wordpress, Wp Time Capsule | 2026-07-15 | 7.5 High |
| WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials. | ||||
| CVE-2019-25763 | 3 Brainstormforce, Ultimatebeaver, Wordpress | 3 Ultimate Addons For Beaver Builder, Ultimate Addons For Beaver Builder, Wordpress | 2026-07-15 | 9.8 Critical |
| WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user. | ||||
| CVE-2018-25236 | 1 Belden | 2 Hirschmann Hios, Hirschmann Hisecos | 2026-07-15 | 9.8 Critical |
| Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials. | ||||
| CVE-2026-20744 | 1 Hydro-québec | 1 Le Circuit Electrique Charging Station Backend | 2026-07-15 | 9.8 Critical |
| The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. | ||||
| CVE-2026-57855 | 1 Agentejo | 1 Cockpit | 2026-07-14 | 8.8 High |
| Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only. | ||||
| CVE-2026-50365 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-07-14 | 8 High |
| Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-50325 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-07-14 | 7 High |
| Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-49805 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-07-14 | 7 High |
| Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58277 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-07-14 | 8.8 High |
| Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-50338 | 1 Microsoft | 2 Azure Spring Apps, Azure Spring Cloud | 2026-07-14 | 8.2 High |
| Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-58631 | 1 Microsoft | 1 Windows Admin Center | 2026-07-14 | 7.8 High |
| Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally. | ||||
| CVE-2026-50311 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-07-14 | 7.8 High |
| Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50297 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-07-14 | 7 High |
| Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-56241 | 1 Cap-go | 1 Cap-go | 2026-07-14 | 8.3 High |
| Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely. | ||||
| CVE-2026-15491 | 1 Rafymrx | 1 Toko-online-roti | 2026-07-14 | 7.3 High |
| A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-15473 | 1 Eleveo | 1 Call Recording Software | 2026-07-14 | 6.3 Medium |
| A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-15627 | 1 Nextlevelbuilder | 1 Goclaw | 2026-07-14 | 4.3 Medium |
| A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used. | ||||
| CVE-2026-62393 | 1 Apache | 1 Kylin | 2026-07-14 | 4.3 Medium |
| Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue. | ||||