Total
398723 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-62693 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 | 2026-08-13 | N/A | 7.0 HIGH |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-71391 | 1 Surrealdb | 1 Surrealdb | 2026-08-13 | N/A | 6.5 MEDIUM |
| SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications. | |||||
| CVE-2026-62695 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-08-13 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-62702 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-08-13 | N/A | 6.8 MEDIUM |
| Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2025-71392 | 1 Surrealdb | 1 Surrealdb | 2026-08-13 | N/A | 8.0 HIGH |
| SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized. | |||||
| CVE-2026-62917 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 4.6 MEDIUM |
| Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | |||||
| CVE-2026-62839 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 6.5 MEDIUM |
| Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | |||||
| CVE-2026-56179 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-08-13 | N/A | 8.3 HIGH |
| Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. | |||||
| CVE-2026-12539 | 2026-08-13 | N/A | N/A | ||
| Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat model treats as untrusted, can therefore defeat the documented ICMP egress block to perform network reconnaissance and exfiltrate data over an ICMP covert channel, regardless of the configured allowlist. | |||||
| CVE-2026-12039 | 2026-08-13 | N/A | N/A | ||
| Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without consulting the policy. A workload inside a sandbox, which the threat model treats as untrusted, can therefore encode data into DNS labels for an attacker-controlled domain and exfiltrate it through a DNS covert channel, bypassing the configured allowlist. | |||||
| CVE-2026-61355 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-08-13 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-61934 | 1 Microsoft | 5 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 2 more | 2026-08-13 | N/A | 7.8 HIGH |
| Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-61927 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-08-13 | N/A | 7.0 HIGH |
| Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-11980 | 4 Apple, Ibm, Linux and 1 more | 4 Macos, Aspera, Linux Kernel and 1 more | 2026-08-13 | N/A | 7.3 HIGH |
| IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | |||||
| CVE-2026-14973 | 4 Apple, Ibm, Linux and 1 more | 4 Macos, Aspera, Linux Kernel and 1 more | 2026-08-13 | N/A | 9.3 CRITICAL |
| IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination. | |||||
| CVE-2026-61357 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-08-13 | N/A | 7.8 HIGH |
| Use after free in Application Information Services allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-70355 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 7.3 HIGH |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-70326 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 8.8 HIGH |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-70324 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 8.8 HIGH |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2025-71396 | 1 Surrealdb | 1 Surrealdb | 2026-08-13 | N/A | 6.5 MEDIUM |
| SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default. | |||||