Export limit exceeded: 378307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 378307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378307 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-64669 | 1 Microsoft | 1 Windows Admin Center | 2026-04-20 | 7.8 High |
| Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-65046 | 1 Microsoft | 2 Edge, Edge Chromium | 2026-04-20 | 3.1 Low |
| Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||||
| CVE-2025-65041 | 1 Microsoft | 1 Partner Center | 2026-04-20 | 10 Critical |
| Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2025-65037 | 1 Microsoft | 1 Azure Container Apps | 2026-04-20 | 10 Critical |
| Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-64676 | 1 Microsoft | 2 Office Purview, Purview | 2026-04-20 | 7.2 High |
| '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-64677 | 1 Microsoft | 2 Office Out-of-box Experience, Office Out Of-box Experience | 2026-04-20 | 8.2 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-64675 | 1 Microsoft | 2 Azure Cosmos Db, Cosmos Db | 2026-04-20 | 8.3 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-61594 | 1 Ruby-lang | 1 Uri | 2026-04-20 | 7.5 High |
| URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4. | ||||
| CVE-2025-62231 | 4 Debian, Ibm, Redhat and 1 more | 17 Debian Linux, Aix, Vios and 14 more | 2026-04-20 | 7.3 High |
| A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. | ||||
| CVE-2025-40103 | 1 Linux | 1 Linux Kernel | 2026-04-20 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks. | ||||
| CVE-2025-14082 | 1 Redhat | 1 Build Keycloak | 2026-04-20 | 2.7 Low |
| A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint. | ||||
| CVE-2026-4622 | 1 Nec | 18 Aterm Gb1200pe, Aterm Gb1200pe Firmware, Aterm Wf1200cr and 15 more | 2026-04-20 | 9.8 Critical |
| OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network. | ||||
| CVE-2026-4621 | 1 Nec | 43 Aterm W1200ex(-ms), Aterm W1200ex-ms, Aterm W1200ex-ms Firmware and 40 more | 2026-04-20 | 5.6 Medium |
| Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network. | ||||
| CVE-2026-4620 | 1 Nec | 4 Aterm Wx1500hp, Aterm Wx1500hp Firmware, Aterm Wx3600hp and 1 more | 2026-04-20 | 9.8 Critical |
| OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network. | ||||
| CVE-2026-4619 | 1 Nec | 2 Aterm Wx3600hp, Aterm Wx3600hp Firmware | 2026-04-20 | 9.8 Critical |
| Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network. | ||||
| CVE-2026-4309 | 1 Nec | 41 Aterm W1200ex(-ms), Aterm W1200ex-ms, Aterm W1200ex-ms Firmware and 38 more | 2026-04-20 | 6.5 Medium |
| Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change the settings via network. | ||||
| CVE-2026-35477 | 2 Inventree, Inventree Project | 2 Inventree, Inventree | 2026-04-20 | 5.5 Medium |
| InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0. | ||||
| CVE-2026-35478 | 2 Inventree, Inventree Project | 2 Inventree, Inventree | 2026-04-20 | 8.3 High |
| InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0. | ||||
| CVE-2025-59024 | 1 Powerdns | 1 Recursor | 2026-04-20 | 6.5 Medium |
| Crafted delegations or IP fragments can poison cached delegations in Recursor. | ||||
| CVE-2025-59023 | 1 Powerdns | 1 Recursor | 2026-04-20 | 8.2 High |
| Crafted delegations or IP fragments can poison cached delegations in Recursor. | ||||