Export limit exceeded: 381652 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 381652 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381652 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69558 | 1 Microsoft | 1 Partner Center | 2026-08-21 | 8.6 High |
| Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69543 | 1 Microsoft | 2 Azure Virtual Machine, Azure Virtual Machines | 2026-08-21 | 8.5 High |
| Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69519 | 1 Microsoft | 1 Azure Stack Hci | 2026-08-21 | 8.6 High |
| Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69419 | 1 Microsoft | 1 Azure Data Manager For Energy | 2026-08-21 | 8.5 High |
| Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-69400 | 1 Microsoft | 1 Azure Logic Apps | 2026-08-21 | 9.6 Critical |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-68782 | 1 Microsoft | 1 Azure Sql Database | 2026-08-21 | 9.9 Critical |
| Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66800 | 1 Microsoft | 1 Azure Data Factory | 2026-08-21 | 8.6 High |
| Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-66309 | 1 Microsoft | 1 Azure Sql Database | 2026-08-21 | 9.1 Critical |
| Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-63509 | 1 Microsoft | 1 Microsoft Fabric | 2026-08-21 | 9.9 Critical |
| Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62945 | 1 Mauriceboe | 1 Trek | 2026-08-21 | 4.3 Medium |
| TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and assignment_id values without using findForeignLinkTarget() to verify that the referenced object belongs to the file's trip. An authenticated user with file-edit permission on any accessible trip can submit a foreign reservation identifier through POST /api/trips/:tripId/files/:id/link, POST /api/trips/:tripId/files, or PUT /api/trips/:tripId/files/:id. Subsequent reads through FILE_SELECT or getFileLinks() join the foreign reservation and return reservation_title, disclosing reservation existence and titles across private trip boundaries. This issue is fixed in version 3.1.3. | ||||
| CVE-2026-61296 | 1 Oracle | 1 Enterprise Asset Management | 2026-08-21 | 7.6 High |
| Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Linear Asset Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Asset Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Asset Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). | ||||
| CVE-2026-61284 | 1 Oracle | 1 Enterprise Manager Base Platform | 2026-08-21 | 8.8 High |
| Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-61281 | 1 Oracle | 1 Hyperion Calculation Manager | 2026-08-21 | 8.1 High |
| Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculation Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Calculation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-61273 | 1 Oracle | 1 Jd Edwards Enterpriseone Tools | 2026-08-21 | 8.8 High |
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-61272 | 1 Oracle | 1 Jd Edwards Enterpriseone Tools | 2026-08-21 | 9.8 Critical |
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-61270 | 1 Oracle | 1 Jd Edwards Enterpriseone Orchestrator | 2026-08-21 | 8.1 High |
| Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Orchestrator accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-61268 | 1 Oracle | 1 Jd Edwards Enterpriseone Tools | 2026-08-21 | 8.1 High |
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-55491 | 1 Bigbluebutton | 1 Bigbluebutton | 2026-08-21 | 5.4 Medium |
| BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29. | ||||
| CVE-2026-55015 | 1 Microsoft | 1 Windows-remote-help | 2026-08-21 | 5.5 Medium |
| Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally. | ||||
| CVE-2026-49436 | 1 Kovah | 1 Linkace | 2026-08-21 | 7.3 High |
| LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue. | ||||