Export limit exceeded: 416092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416092 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12507 | 1 Zohocorp | 4 Assetexplorer, Servicedesk Plus, Servicedesk Plus Msp and 1 more | 2026-11-12 | 9.1 Critical |
| Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server. | ||||
| CVE-2026-118120 | 1 Microsoft | 9 Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 6 more | 2026-11-12 | 8.8 High |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-118148 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.5 High |
| Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-87772 | 2026-11-12 | 7.8 High | ||
| Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation. This issue affects Pardus About: before 1.2.5. | ||||
| CVE-2026-118715 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-118716 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118718 | 1 Microsoft | 11 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 8 more | 2026-11-12 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-117546 | 1 Adobe | 1 Photoshop | 2026-11-12 | 7.8 High |
| Photoshop Desktop is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-118479 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-11-12 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-118480 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-11-12 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-118481 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-11-12 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-96541 | 2 Gnome, Redhat | 4 Gnome-remote-desktop, Enterprise Linux, Enterprise Linux Eus and 1 more | 2026-11-12 | 7.5 High |
| A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed. | ||||
| CVE-2026-76878 | 1 Openstack | 1 Aodh | 2026-11-12 | 6.3 Medium |
| In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0). | ||||
| CVE-2026-126673 | 2026-11-12 | N/A | ||
| Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping "$" or "@", so "@{[ ... ]}" and "${\ ... }" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code. | ||||
| CVE-2026-114605 | 1 Rthalley | 1 Dnspython | 2026-11-12 | 7.5 High |
| dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0. | ||||
| CVE-2026-113764 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-11-12 | 4.7 Medium |
| Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-113766 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-11-12 | 3.3 Low |
| Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-118597 | 1 Akaunting | 1 Akaunting | 2026-11-12 | N/A |
| Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin. | ||||
| CVE-2026-108401 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 8.8 High |
| Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-113844 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 5.5 Medium |
| Improper access control in Windows NTFS allows an authorized attacker to perform tampering locally. | ||||