Export limit exceeded: 415263 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415263 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68486 | 2026-11-11 | N/A | ||
| An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations. | ||||
| CVE-2026-77168 | 2026-11-11 | N/A | ||
| A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim's session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler. | ||||
| CVE-2026-82978 | 2026-11-11 | N/A | ||
| An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields. | ||||
| CVE-2026-86363 | 2026-11-11 | 5.5 Medium | ||
| Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. | ||||
| CVE-2026-109478 | 1 Microsoft | 9 .net 8.0 Installed On Linux, .net 8.0 Installed On Mac Os, .net 8.0 Installed On Windows and 6 more | 2026-11-11 | 7.5 High |
| Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-109454 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 9 Critical |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-109456 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 4.6 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-109457 | 1 Microsoft | 1 Azure Machine Learning | 2026-11-11 | 8 High |
| Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-109460 | 1 Microsoft | 1 Entra Private Network Connector | 2026-11-11 | 5.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-109464 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-109466 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-109472 | 1 Microsoft | 1 Sharepoint Server | 2026-11-11 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-109481 | 1 Microsoft | 4 .net 11.0 Installed On Linux, .net 11.0 Installed On Mac Os, .net 11.0 Installed On Windows and 1 more | 2026-11-11 | 7.5 High |
| Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-109492 | 1 Microsoft | 1 Mcp Gateway | 2026-11-11 | 8.8 High |
| Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-108425 | 1 Microsoft | 7 Windows Server 2016, Windows Server 2016 (server Core Installation), Windows Server 2019 and 4 more | 2026-11-11 | 5.9 Medium |
| Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-109485 | 1 Microsoft | 1 Microsoft Agent Framework Sdk For Dotnet | 2026-11-11 | 6.3 Medium |
| Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-109487 | 1 Microsoft | 10 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 7 more | 2026-11-11 | 7.5 High |
| Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-105509 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-11-11 | 7 High |
| Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-105507 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-11 | 7.8 High |
| An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. | ||||
| CVE-2026-105515 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-11 | 7.5 High |
| Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network. | ||||