Search vulnerabilities

Expected end of text, found '/' (at char 49), (line:1, col:50)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,805

CVE-2026-109807

Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109796

Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-4897

Polkit: polkit: denial of service via unbounded input processing through standard input

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Freedesktop Redhat
Products
Polkit Enterprise Linux Hummingbird and 3 more
CVE-2026-41214

neural-compressor: neural-compressor: Denial of Service via improper input validation

Improper input validation for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-69555

Azure Arc Elevation of Privilege Vulnerability

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Arc
CVE-2026-66798

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge Edge Chromium
CVE-2026-68798

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Microsoft 365 Office 2021 and 4 more
CVE-2026-67177

Chargemap stored XSS

Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-67176

Chargemap open redirect

Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a crafted URL to a victim and redirect them to an attacker controlled domain. Fixed 2026-07-17.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-68807

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 14 more
CVE-2026-68800

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 14 more
CVE-2026-67175

Chargemap stored XSS

Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62740

Windows Imaging Component Information Disclosure Vulnerability

Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office Office 365 Office Macos 2021 and 27 more
CVE-2026-105613

PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions

PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer