Export limit exceeded: 377331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377331 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-47233 | 1 Admidio | 1 Admidio | 2026-08-13 | 6.5 Medium |
| Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix. | ||||
| CVE-2026-62877 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 7.8 High |
| Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-18246 | 1 Ibm | 1 I | 2026-08-13 | 3 Low |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser. | ||||
| CVE-2026-17095 | 1 Ibm | 1 I | 2026-08-13 | 8.3 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection. | ||||
| CVE-2026-66478 | 2 Andymoyle, Wordpress | 2 Church Admin, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | ||||
| CVE-2026-66660 | 2 Scottpaterson, Wordpress | 2 Contact Form 7 – Paypal & Stripe Add-on, Wordpress | 2026-08-13 | 6.5 Medium |
| Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | ||||
| CVE-2026-6387 | 1 Lenovo | 1 System Update | 2026-08-13 | 7 High |
| A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges. | ||||
| CVE-2026-63424 | 1 Lenovo | 1 Dock Manager | 2026-08-13 | 7.3 High |
| During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges. | ||||
| CVE-2026-66472 | 2 Everestthemes, Wordpress | 2 Everest Backup, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | ||||
| CVE-2026-66655 | 2 Multiparcels, Wordpress | 2 Multiparcels Shipping For Woocommerce, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | ||||
| CVE-2026-65678 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-08-13 | 7 High |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62746 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 5.5 Medium |
| Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-25652 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 7.8 High |
| is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-62798 | 1 Microsoft | 9 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 6 more | 2026-08-13 | 5.5 Medium |
| Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-65784 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 5.5 Medium |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-65785 | 1 Microsoft | 7 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 4 more | 2026-08-13 | 6.5 Medium |
| Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. | ||||
| CVE-2026-62774 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-08-13 | 7 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-34635 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 8.4 High |
| is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-62796 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 5.5 Medium |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-61939 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 7 High |
| Use after free in Winlogon allows an authorized attacker to elevate privileges locally. | ||||