Export limit exceeded: 395017 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395017 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87701 | 1 Microsoft | 1 Cosmos Db | 2026-09-17 | 9.6 Critical |
| Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-78501 | 1 Microsoft | 1 365 Copilot Business Chat | 2026-09-17 | 7.4 High |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-83944 | 1 Microsoft | 1 Azure Logic Apps | 2026-09-17 | 10 Critical |
| Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-85885 | 1 Microsoft | 1 365 Copilot | 2026-09-17 | 9.9 Critical |
| Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-68791 | 1 Microsoft | 1 Azure Machine Learning | 2026-09-17 | 8.6 High |
| Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69399 | 1 Microsoft | 1 Azure Arc | 2026-09-17 | 10 Critical |
| Azure Arc Elevation of Privilege Vulnerability | ||||
| CVE-2026-77903 | 1 Microsoft | 1 Dataverse | 2026-09-17 | 9 Critical |
| Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69865 | 1 Microsoft | 1 Azure Container Registry | 2026-09-17 | 10 Critical |
| Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70009 | 1 Microsoft | 1 Azure Arc | 2026-09-17 | 9.3 Critical |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-55946 | 1 Microsoft | 1 Copilot | 2026-09-17 | 6.1 Medium |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-81872 | 1 Opentelemetry | 1 Opentelemetry-go | 2026-09-17 | N/A |
| OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0. | ||||
| CVE-2025-59607 | 1 Qualcomm | 1 Snapdragon | 2026-09-17 | 7.8 High |
| Memory Corruption when copying large input data exceeds normal allocation limits. | ||||
| CVE-2026-78940 | 1 Google | 1 Chrome | 2026-09-17 | 4.3 Medium |
| Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-56176 | 1 Microsoft | 28 Office, Office 365, Office Macos 2021 and 25 more | 2026-09-17 | 7.8 High |
| Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-66269 | 1 Dell | 4 Dell Openmanage Server Administrator Managed Node (patch) For Windows, Dell Openmanage Server Administrator Managed Node For Rhel 8.10, Dell Openmanage Server Administrator Managed Node For Rhel 9.4 and 1 more | 2026-09-17 | 7.3 High |
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | ||||
| CVE-2026-81478 | 2026-09-17 | 8.1 High | ||
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-81480 | 2026-09-17 | 7.2 High | ||
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. | ||||
| CVE-2026-66574 | 2 Bdthemes, Wordpress | 2 Element Pack Elementor Addons, Wordpress | 2026-09-17 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions. | ||||
| CVE-2026-74005 | 2 Publishpress, Wordpress | 2 Publishpress Series, Wordpress | 2026-09-17 | 5.4 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. | ||||
| CVE-2026-40400 | 1 Microsoft | 19 Powershell, Windows 10 1607, Windows 10 1809 and 16 more | 2026-09-17 | 8 High |
| Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network. | ||||