Export limit exceeded: 16805 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16805 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96162 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7.8 High |
| Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96029 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 7.8 High |
| Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-95988 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-11-10 | 7.8 High |
| Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96133 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-10 | 5.5 Medium |
| Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-109466 | 1 Microsoft | 1 Sharepoint Server | 2026-11-10 | 8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-109455 | 1 Microsoft | 1 Sharepoint Server | 2026-11-10 | 6.5 Medium |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-88176 | 1 Microsoft | 1 Sharepoint Server | 2026-11-10 | 8.8 High |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-121225 | 1 Google | 1 Chrome | 2026-11-10 | 6.5 Medium |
| Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-58866 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58867 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58873 | 1 Google | 1 Android Xr | 2026-11-10 | 8.4 High |
| In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58870 | 1 Google | 1 Android | 2026-11-10 | 4 Medium |
| In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58951 | 1 Google | 1 Android | 2026-11-10 | 4 Medium |
| In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-81744 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 6.5 Medium |
| Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-81734 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 6.5 Medium |
| Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly invoking catalog quick-admin events such as updateProductQuickAdminShipping, causing the servlet to authorize the request against the base view-level permission declared on the request-map while the underlying event methods perform entity-engine writes without checking the catalog update/create permission enforced by equivalent sibling event methods in the same class. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-76152 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 6.5 Medium |
| Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-76150 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 6.5 Medium |
| Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-73580 | 2 Apache, Apache Software Foundation | 2 Ofbiz, Apache Ofbiz | 2026-11-10 | 5.3 Medium |
| Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue. | ||||
| CVE-2026-59001 | 1 Google | 1 Android | 2026-11-10 | 4 Medium |
| In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-16711 | 1 Ibm | 1 Api Connect | 2026-11-10 | 5.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests. | ||||