Export limit exceeded: 389958 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (9618 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87468 | 1 Google | 1 Chrome | 2026-09-11 | 6.5 Medium |
| Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-89087 | 2026-09-10 | 7.3 High | ||
| The cstruct package before 6.3.0 for OCaml mishandles indexes. | ||||
| CVE-2026-67368 | 1 Microsoft | 4 Sql Server 2017, Sql Server 2019, Sql Server 2022 and 1 more | 2026-09-10 | 8.8 High |
| Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-88059 | 2026-09-10 | 4 Medium | ||
| Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1. | ||||
| CVE-2026-81784 | 2026-09-10 | 8.1 High | ||
| Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions. | ||||
| CVE-2025-46808 | 1 Suse | 1 Neuvector | 2026-09-10 | 6.8 Medium |
| An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5. | ||||
| CVE-2026-69379 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-09-10 | 7 High |
| Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69507 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-09-10 | 5.7 Medium |
| Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-69694 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-10 | 7 High |
| Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69771 | 1 Microsoft | 8 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 5 more | 2026-09-10 | 4.7 Medium |
| Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-70563 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-10 | 8.1 High |
| Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-68831 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-10 | 5.5 Medium |
| Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-68873 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-09-10 | 5.5 Medium |
| Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69289 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-10 | 7.8 High |
| Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69425 | 1 Microsoft | 8 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 5 more | 2026-09-10 | 4.7 Medium |
| Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-87475 | 1 Google | 1 Chrome | 2026-09-10 | 6.5 Medium |
| Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-77484 | 1 Microsoft | 8 Microsoft Sql Server 2019 (cu 32), Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr) and 5 more | 2026-09-10 | 8.8 High |
| Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-81385 | 1 Microsoft | 7 365 Apps, Microsoft 365 Apps For Enterprise, Office 2019 and 4 more | 2026-09-10 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-8862 | 1 Ibm | 2 Netezza Performance Server, Netezza Software | 2026-09-10 | 7.5 High |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information. | ||||
| CVE-2026-87993 | 2026-09-10 | 7.7 High | ||
| The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0. | ||||