2026 CVEs (page 25)
Page 25 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73087 | | 2026-08-11 | Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, us… | |
CVE-2026-73086 | High | 7.4 | 2026-08-11 | nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and ind… |
CVE-2026-73085 | | 2026-08-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the re… | |
CVE-2026-73084 | Medium | 6.1 | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query… |
CVE-2026-73083 | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with impo… | |
CVE-2026-73082 | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoi… | |
CVE-2026-73081 | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step… | |
CVE-2026-72971 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to p… |
CVE-2026-71390 | Medium | 4.0 | 2026-08-11 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-71389 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-71387 | High | 8.8 | 2026-08-11 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacke… |
CVE-2026-71386 | High | 8.8 | 2026-08-11 | is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e… |
CVE-2026-71384 | Critical | 9.6 | 2026-08-11 | is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass… |
CVE-2026-71383 | High | 7.3 | 2026-08-11 | is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass… |
CVE-2026-71331 | High | 8.1 | 2026-08-11 | Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code ove… |
CVE-2026-70355 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70354 | High | 7.8 | 2026-08-11 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
CVE-2026-70348 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally. |
CVE-2026-70347 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70346 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70345 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70344 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70340 | High | 8.1 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70338 | High | 7.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-70337 | High | 8.8 | 2026-08-11 | Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-70336 | High | 8.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-70335 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized atta… |
CVE-2026-70330 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-70329 | High | 8.8 | 2026-08-11 | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-70328 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70327 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70326 | High | 8.8 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70325 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70324 | High | 8.8 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70323 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70322 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70321 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-70320 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70319 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70318 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-70317 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70316 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70315 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70314 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70313 | High | 7.8 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70312 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70311 | High | 7.8 | 2026-08-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-70310 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70307 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-70306 | Critical | 9.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-70304 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-70130 | High | 8.4 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-69320 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute cod… |
CVE-2026-69306 | High | 8.2 | 2026-08-11 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69278 | High | 7.8 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-69223 | Critical | 9.1 | 2026-08-11 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgr… |
CVE-2026-68821 | High | 7.3 | 2026-08-11 | Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-68820 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-68819 | Medium | 5.9 | 2026-08-11 | Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network. |
CVE-2026-68817 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68816 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68815 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68814 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68813 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68812 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68811 | High | 7.8 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68810 | High | 7.8 | 2026-08-11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68809 | Medium | 5.5 | 2026-08-11 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-68808 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68807 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68806 | High | 7.8 | 2026-08-11 | Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68805 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68804 | High | 7.8 | 2026-08-11 | Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68803 | High | 7.8 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68802 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68801 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68800 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68799 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68798 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68797 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68796 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68795 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68794 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68793 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68792 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges loc… |
CVE-2026-66810 | Medium | 5.5 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66809 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-66808 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-66807 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66805 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-66804 | High | 7.8 | 2026-08-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-66802 | High | 8.1 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Azure Attestation service and Device Health Attestatio… |
CVE-2026-66799 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally. |
CVE-2026-66301 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a… |
CVE-2026-65815 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. |
CVE-2026-65814 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-65813 | Medium | 6.5 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-65811 | High | 8.8 | 2026-08-11 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
CVE-2026-65810 | High | 7.8 | 2026-08-11 | Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally. |