Export limit exceeded: 350235 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (350235 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-31230 | 2026-05-12 | N/A | ||
| The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py). The script uses the unsafe eval() function to parse string values provided via the --clip_values and --input_shape command-line arguments. This allows an attacker to inject arbitrary Python code into these arguments, which will be executed when eval() is called. The vulnerability can be exploited remotely if an attacker can control these arguments (e.g., through pipeline configuration or automated scripts), leading to arbitrary code execution on the system running the ART evaluation. | ||||
| CVE-2026-31229 | 2026-05-12 | N/A | ||
| The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component's model loading functionality. When loading model weights from a file (e.g., model.pt) during robustness evaluation, the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by uploading a maliciously crafted model file to an object storage location referenced by the pipeline, or by controlling the model_id parameter to point to such a file. When the pipeline loads the model, the malicious payload is executed, leading to remote code execution. | ||||
| CVE-2026-39454 | 1 Skygroup | 2 Skymec It Manager, Skysea Client View | 2026-05-12 | N/A |
| SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-administrative user may manipulate and/or place arbitrary files within the installation folder of the product. As a result, arbitrary code may be executed with the administrative privilege. | ||||
| CVE-2026-8110 | 1 Ivanti | 1 Endpoint Manager | 2026-05-12 | 7.8 High |
| Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges. | ||||
| CVE-2025-70842 | 1 Fluentcms | 1 Fluentcms | 2026-05-12 | 5.4 Medium |
| A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who accesses the direct URL of the image, including unauthenticated visitors. | ||||
| CVE-2026-5061 | 1 Hashicorp | 1 Consul Template | 2026-05-12 | 4.7 Medium |
| The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0. | ||||
| CVE-2026-33821 | 1 Microsoft | 1 Dynamics 365 | 2026-05-12 | 7.7 High |
| Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-42893 | 1 Microsoft | 1 Outlook | 2026-05-12 | 7.4 High |
| Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-42838 | 1 Microsoft | 1 Edge Chromium | 2026-05-12 | 5.4 Medium |
| Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-40416 | 1 Microsoft | 1 Edge Chromium | 2026-05-12 | 4.3 Medium |
| User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-42833 | 1 Microsoft | 1 Dynamics 365 | 2026-05-12 | 9.1 Critical |
| Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-42832 | 1 Microsoft | 4 Excel, Office Macos 2021, Office Macos 2024 and 1 more | 2026-05-12 | 7.7 High |
| Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. | ||||
| CVE-2026-42830 | 1 Microsoft | 1 Azure Monitor Agent Metrics Extension | 2026-05-12 | 6.5 Medium |
| Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-42823 | 1 Microsoft | 1 Azure Logic Apps | 2026-05-12 | 9.9 Critical |
| Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-41613 | 1 Microsoft | 1 Visual Studio Code | 2026-05-12 | 8.8 High |
| Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-41103 | 1 Microsoft | 2 Confluence Saml Sso Plugin, Jira Saml Sso Plugin | 2026-05-12 | 9.1 Critical |
| Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-40381 | 1 Microsoft | 1 Azure Connected Machine Agent | 2026-05-12 | 7.8 High |
| Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-41097 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-05-12 | 6.7 Medium |
| Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-41086 | 1 Microsoft | 1 Azure Portal Windows Admin Center | 2026-05-12 | 8.8 High |
| Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-40420 | 1 Microsoft | 4 365 Apps, Office 2019, Office 2021 and 1 more | 2026-05-12 | 8.8 High |
| Improper access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | ||||