Export limit exceeded: 359550 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 359550 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11339 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-29827 | 1 Microsoft | 1 Azure Automation | 2026-02-13 | 9.9 Critical |
| Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2025-49723 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-02-13 | 8.8 High |
| Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally. | ||||
| CVE-2025-50171 | 1 Microsoft | 12 Server, Windows, Windows 10 21h2 and 9 more | 2026-02-13 | 9.1 Critical |
| Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-14592 | 1 Gitlab | 1 Gitlab | 2026-02-13 | 3.7 Low |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint. | ||||
| CVE-2025-70997 | 2 Eladmin, Elunez | 2 Eladmin, Eladmin | 2026-02-12 | 8.1 High |
| A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level. | ||||
| CVE-2025-15395 | 1 Ibm | 1 Jazz Foundation | 2026-02-11 | 4.3 Medium |
| IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or access/perform actions beyond their expected capability. | ||||
| CVE-2025-66719 | 1 Free5gc | 1 Nrf | 2026-02-11 | 9.1 Critical |
| An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/processor/access_token.go bypasses all scope validation when the attacker uses a crafted targetNF value. This allows attackers to obtain an access token with any arbitrary scope. | ||||
| CVE-2025-70983 | 2 Bladex, Springblade Project | 2 Springblade, Springblade | 2026-02-11 | 9.9 Critical |
| Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. | ||||
| CVE-2025-52024 | 1 Aptsys | 2 Gemscms Backend, Pos Platform Web Services | 2026-02-11 | 9.4 Critical |
| A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries. | ||||
| CVE-2024-21417 | 1 Microsoft | 15 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 12 more | 2026-02-10 | 8.8 High |
| Windows Text Services Framework Elevation of Privilege Vulnerability | ||||
| CVE-2025-15342 | 1 Tanium | 2 Reputation, Service Reputation | 2026-02-10 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Reputation. | ||||
| CVE-2025-15289 | 1 Tanium | 2 Interact, Service Interact | 2026-02-10 | 3.1 Low |
| Tanium addressed an improper access controls vulnerability in Interact. | ||||
| CVE-2025-15330 | 1 Tanium | 2 Deploy, Service Deploy | 2026-02-10 | 8.8 High |
| Tanium addressed an improper input validation vulnerability in Deploy. | ||||
| CVE-2025-15327 | 1 Tanium | 2 Deploy, Service Deploy | 2026-02-10 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Deploy. | ||||
| CVE-2025-15326 | 1 Tanium | 2 Patch, Service Patch | 2026-02-10 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Patch. | ||||
| CVE-2025-15321 | 1 Tanium | 1 Tanos | 2026-02-10 | 2.7 Low |
| Tanium addressed an improper input validation vulnerability in Tanium Appliance. | ||||
| CVE-2025-2848 | 1 Synology | 2 Diskstation Manager, Mail Server | 2026-02-09 | 6.3 Medium |
| A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions. | ||||
| CVE-2025-68140 | 2 Everest, Linuxfoundation | 2 Everest-core, Everest | 2026-02-06 | 4.3 Medium |
| EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue. | ||||
| CVE-2025-13985 | 2 Drupal, Ithom | 2 Entity Share, Entity Share | 2026-02-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. | ||||
| CVE-2025-27461 | 1 Endress | 2 Meac300-fnade4, Meac300-fnade4 Firmware | 2026-02-06 | 7.6 High |
| During startup, the device automatically logs in the EPC2 Windows user without requesting a password. | ||||