Export limit exceeded: 89500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (89500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-50425 | 1 Microsoft | 6 Windows 10 21h2, Windows 10 22h2, Windows 11 24h2 and 3 more | 2026-07-15 | 7.8 High |
| Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50463 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-15 | 7.5 High |
| Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-50344 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-07-15 | 7.8 High |
| Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50406 | 1 Microsoft | 5 Windows 10 21h2, Windows 10 22h2, Windows 11 24h2 and 2 more | 2026-07-15 | 7 High |
| Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50470 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-07-15 | 7.5 High |
| Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-50502 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-07-15 | 8 High |
| Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-50496 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-07-15 | 7.5 High |
| Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-50680 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-15 | 8.2 High |
| Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50686 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-15 | 8.1 High |
| Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-56173 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-07-15 | 7 High |
| Use after free in Windows WebView allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-56183 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 | 2026-07-15 | 7 High |
| Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50665 | 1 Microsoft | 8 365 Apps, Office 2016, Office 2019 and 5 more | 2026-07-15 | 7.8 High |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-56642 | 2 Fabric, Microsoft | 2 Data Warehouse, Service Fabric | 2026-07-15 | 8.8 High |
| Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-57089 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-07-15 | 7.5 High |
| Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-58628 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-15 | 7.8 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-48069 | 2026-07-15 | 7.5 High | ||
| @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. | ||||
| CVE-2026-50663 | 1 Microsoft | 2 Age Of Empires Ii, Age Of Empires Ii | 2026-07-15 | 8.8 High |
| Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-56398 | 1 Openwebui | 1 Open Webui | 2026-07-15 | 7.3 High |
| Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover. | ||||
| CVE-2026-61433 | 1 Praison | 1 Praisonai | 2026-07-15 | 7.8 High |
| PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests. | ||||
| CVE-2026-61446 | 1 Praison | 1 Praisonai | 2026-07-15 | 8.4 High |
| PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes. | ||||