Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425824 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59235 | 1 Roskus | 1 Prospero Flow Crm | 2026-07-15 | N/A |
| Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privileged role (e.g. the "User"/"Usuario" role) to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token, because the API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'), and the handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it. | ||||
| CVE-2026-59236 | 1 Roskus | 1 Prospero Flow Crm | 2026-07-15 | N/A |
| Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save, which maps company_id directly from the file and performs no check that it matches the authenticated user's company. | ||||
| CVE-2026-61430 | 1 Praison | 1 Praisonai | 2026-07-15 | 8.5 High |
| PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services. | ||||
| CVE-2026-48367 | 1 Adobe | 1 After Effects | 2026-07-15 | 7.8 High |
| After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48269 | 1 Adobe | 2 Premiere, Premiere Pro | 2026-07-15 | 7.8 High |
| Premiere Pro is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48274 | 1 Adobe | 1 After Effects | 2026-07-15 | 7.8 High |
| After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-56401 | 1 Wazuh | 1 Wazuh | 2026-07-15 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-47305 | 1 Microsoft | 2 Visual Studio 2022, Visual Studio 2026 | 2026-07-15 | 7.8 High |
| Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-54131 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2019 and 6 more | 2026-07-15 | 7.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55131 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-07-15 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-47642 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2019 and 6 more | 2026-07-15 | 7.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55140 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-07-15 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55129 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-07-15 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55125 | 1 Microsoft | 12 365 Apps, Microsoft 365, Office 2016 and 9 more | 2026-07-15 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55056 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-07-15 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55049 | 1 Microsoft | 8 365 Apps, Office 2016, Office 2019 and 5 more | 2026-07-15 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-55022 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-07-15 | 7.8 High |
| Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-50467 | 1 Microsoft | 9 365 Apps, Microsoft 365, Office 2016 and 6 more | 2026-07-15 | 7.8 High |
| Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-47290 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-07-15 | 7.8 High |
| Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-49173 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-07-15 | 7.8 High |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||