Export limit exceeded: 393967 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (393967 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89156 | 1 Pcre | 1 Pcre2 | 2026-09-16 | 2.9 Low |
| PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. | ||||
| CVE-2026-69646 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 8.3 High |
| Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network. | ||||
| CVE-2026-69642 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 6.5 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-89157 | 1 Pcre | 1 Pcre2 | 2026-09-16 | 5.7 Medium |
| PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. | ||||
| CVE-2026-66308 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 6.5 Medium |
| Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-66307 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 7.5 High |
| Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-66306 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 6.5 Medium |
| Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-66305 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 7.1 High |
| Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-89158 | 1 Pcre | 1 Pcre2 | 2026-09-16 | 6.5 Medium |
| PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. | ||||
| CVE-2026-66304 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 7.5 High |
| Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-66303 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 6.5 Medium |
| Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-66302 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 9.8 Critical |
| External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-63523 | 1 Microsoft | 4 Skype For Business Server, Skype For Business Server 2015, Skype For Business Server 2019 and 1 more | 2026-09-16 | 6.5 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-92299 | 1 Jitsi | 1 Jitsi | 2026-09-16 | 7.4 High |
| @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts. | ||||
| CVE-2026-92259 | 1 Samsung Open Source | 1 Escargot | 2026-09-16 | 5.5 Medium |
| Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238. | ||||
| CVE-2026-92234 | 1 Webkul | 1 Qloapps | 2026-09-16 | 5.4 Medium |
| QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter. | ||||
| CVE-2026-92216 | 1 A2ui-project | 1 A2ui | 2026-09-16 | 4.3 Medium |
| A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-92141 | 2026-09-16 | 4.3 Medium | ||
| Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. | ||||
| CVE-2026-92140 | 2026-09-16 | 6.8 Medium | ||
| Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint. | ||||
| CVE-2026-92139 | 2026-09-16 | 6.5 Medium | ||
| Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. | ||||