Total
408356 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-62241 | 1 Mohibshaikh | 1 Clawvet | 2026-08-14 | N/A | 9.1 CRITICAL |
| clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected. | |||||
| CVE-2026-58643 | 1 Microsoft | 1 Windows Admin Center | 2026-08-14 | N/A | 6.1 MEDIUM |
| Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-48566 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-08-14 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-32202 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-14 | N/A | 4.3 MEDIUM |
| Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-32153 | 1 Microsoft | 7 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 4 more | 2026-08-14 | N/A | 7.8 HIGH |
| Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2023-7347 | 2026-08-14 | N/A | N/A | ||
| Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |||||
| CVE-2026-64910 | 1 Microsoft | 5 365 Apps, Microsoft 365, Office 2019 and 2 more | 2026-08-14 | N/A | 7.8 HIGH |
| Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-70338 | 1 Microsoft | 1 Powershell | 2026-08-14 | N/A | 7.8 HIGH |
| Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-70130 | 1 Microsoft | 4 365 Apps, Office 2019, Office 2021 and 1 more | 2026-08-14 | N/A | 8.4 HIGH |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-66807 | 1 Microsoft | 5 365 Apps, Microsoft 365, Office 2019 and 2 more | 2026-08-14 | N/A | 7.8 HIGH |
| Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-63515 | 1 Microsoft | 6 365 Apps, Microsoft 365, Office 2016 and 3 more | 2026-08-14 | N/A | 7.8 HIGH |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-62913 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-08-14 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-46600 | 2026-08-14 | N/A | 7.5 HIGH | ||
| Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. | |||||
| CVE-2026-44962 | 2026-08-14 | N/A | 9.9 CRITICAL | ||
| Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation. | |||||
| CVE-2026-19345 | 2026-08-14 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-19330 | 2026-08-14 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system_json/switch_memory_library of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-19325 | 2026-08-14 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component read_memory_bank_file/append_memory_bank_entry. Such manipulation of the argument file_name leads to path traversal. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-19285 | 2026-08-14 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.createDomain/JsonMemoryStorage.getMemories/JsonMemoryStorage.saveMemories of the file src/tools/memoryTools.ts. The manipulation results in path traversal. The attack must be initiated from a local position. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-19270 | 2026-08-14 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-19246 | 2026-08-14 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/providers/image_generation.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5095. It is recommended to apply a patch to fix this issue. The vendor explains: "We confirm that provider-returned image URLs required the same SSRF protections applied to other network retrieval paths. (...) The patch is currently available on main and is planned for the next patch release, v0.3.1." | |||||