Export limit exceeded: 13980 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (13980 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19192 | 1 Deepcool | 1 Displayservice | 2026-08-07 | 7.8 High |
| A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit is now public and may be used. | ||||
| CVE-2026-71326 | 1 Traefik | 1 Traefik | 2026-08-07 | N/A |
| Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10. | ||||
| CVE-2026-65668 | 1 Microsoft | 2 Office Purview Ediscovery, Purview Ediscovery | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-19064 | 1 Sourcecodester | 2 Online Examination Learning Management System, Onlne Examination Learning Management System | 2026-08-07 | 4.3 Medium |
| A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely. | ||||
| CVE-2026-64665 | 1 Statamic | 1 Cms | 2026-08-07 | 8.1 High |
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0. | ||||
| CVE-2026-67687 | 2026-08-07 | N/A | ||
| Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java | ||||
| CVE-2026-56161 | 1 Microsoft | 1 Azure Logic Apps | 2026-08-07 | 9.6 Critical |
| Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-59118 | 1 Microsoft | 1 Power-apps | 2026-08-07 | 9.3 Critical |
| Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62896 | 1 Microsoft | 1 Teams | 2026-08-07 | 9.6 Critical |
| Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-14306 | 2026-08-07 | 4.3 Medium | ||
| The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses. | ||||
| CVE-2026-13342 | 2026-08-06 | 5.3 Medium | ||
| The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured. | ||||
| CVE-2026-12584 | 2026-08-06 | 7.5 High | ||
| The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying. | ||||
| CVE-2026-66451 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-08-06 | 6.5 Medium |
| Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. | ||||
| CVE-2026-18974 | 1 Heshengtao | 1 Super-agent-party | 2026-08-06 | 5.3 Medium |
| A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19066 | 1 Sourcecodester | 1 Online Examination Learning Management System | 2026-08-06 | 4.3 Medium |
| A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students.php. Such manipulation of the argument class_group leads to authorization bypass. The attack may be launched remotely. | ||||
| CVE-2026-19065 | 1 Sourcecodester | 1 Online Examination Learning Management System | 2026-08-06 | 6.3 Medium |
| A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files.php. This manipulation causes unrestricted upload. The attack may be initiated remotely. | ||||
| CVE-2026-66425 | 2 Saadiqbal, Wordpress | 2 Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, And Custom Form Builder, Wordpress | 2026-08-06 | 6.5 Medium |
| Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions. | ||||
| CVE-2025-14561 | 1 Wso2 | 6 Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Carbon Api Management Implementation and 3 more | 2026-08-06 | 9 Critical |
| In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments. | ||||
| CVE-2026-18990 | 1 Letta-ai | 1 Lettabot | 2026-08-06 | 7.3 High |
| A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-70430 | 1 Jenkins Project | 1 Jenkins | 2026-08-06 | 2.7 Low |
| Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators. | ||||