Archive
11 August 2026
Vulnerabilities first published on this day (UTC), newest first.
345 results · Clear filters · Feed
-
Medium 5.5
Windows Hello Tampering Vulnerability
Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.
-
Medium 6.5
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
Medium 5.0
Windows Hyper-V Information Disclosure Vulnerability
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information locally.
-
Medium 4.6
Windows NTFS Information Disclosure Vulnerability
Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Remote Registry Service Denial of Service Vulnerability
Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
-
Medium 5.5
Windows Event Logging Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft Remote Registry Service Denial of Service Vulnerability
Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.
-
Medium 5.5
Microsoft COM for Windows Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.
-
Medium 5.5
Microsoft Windows Search Component Information Disclosure Vulnerability
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
-
Medium 5.6
AMD Zen Information Disclosure Vulnerability
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Encrypting File System (EFS) Information Disclosure Vulnerability
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
-
Medium 6.5
Visual Studio Code Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Dynamics Business Central Information Disclosure Vulnerability
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft SharePoint Server Tampering Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
-
Medium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Medium 6.2
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service…
-
Medium 6.2
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service…
-
Medium 4.7
CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a …
-
Medium 4.0
CAI Content Credentials | Improper Input Validation (CWE-20)
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitatio…
-
Medium 6.2
CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Expl…
-
Medium 6.5
CAI Content Credentials | Improper Input Validation (CWE-20)
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of thi…
-
Medium 6.2
CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Expl…
-
Medium 5.5
CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and di…
-
Medium 6.2
CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Expl…
-
Medium 6.2
CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditi…
-
Medium 6.2
CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditi…
-
Medium 5.5
CAI Content Credentials | Improper Certificate Validation (CWE-295)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation …
-
Medium 5.3
Audiobookshelf: Refresh Token Accepted on Resource Endpoints
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me ins…
-
Medium 6.1
Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/re…
-
Medium 6.5
ColdFusion | Incorrect Authorization (CWE-863)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitati…
-
Medium 4.9
ColdFusion | Improper Input Validation (CWE-20)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. E…
-
Medium 4.6
ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse …
-
Medium 5.4
ColdFusion | Improper Encoding or Escaping of Output (CWE-116)
is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing…
-
Medium 5.3
Activepieces: Server-side request forgery in MCP tool validation endpoint
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF…
-
Medium 6.3
Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applicati…
-
Medium 4.3
Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitive…
-
Medium 4.5
Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow …