CVE-2026-65xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
632 records · Page 2 of 7
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.
UpdatedServer-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
UpdatedInsertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
UpdatedImproper input validation in Power BI allows an authorized attacker to execute code over a network.
UpdatedRelative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedMissing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
UpdatedImproper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
UpdatedExternal control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
UpdatedInteger overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedNumeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedNumeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
UpdatedRelative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
UpdatedBuffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows DNS allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedUncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.
UpdatedOut-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
UpdatedUse after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedDouble free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
UpdatedInadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.
UpdatedUse after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedDeserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
Updated- CVE-2026-65770: Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability 10.0 Critical
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.
Updated Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.
UpdatedImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.
Updated- CVE-2026-65766: Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 9.2 Critical
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.
Updated Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
Updated- CVE-2026-65764: Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1 5.1 Medium
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Updated - CVE-2026-65763: Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 5.1 Medium
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Updated Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Updated- CVE-2026-65761: Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 9.3 Critical
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.
Updated Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
UpdatedJoomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.
UpdatedJoomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
UpdatedJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
Updated- CVE-2026-65756: Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension 6.1 Medium
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
Updated Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
UpdatedJoomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
Updated- CVE-2026-65713: Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension 6.5 Medium
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.
Updated Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.
UpdatedsysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or e
Updated- CVE-2026-65710: sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption 7.1 High
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the public link creation flow. Attackers can invoke the saveCreateFromAccountAction endpoint to cause AccountS
Updated sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without Account
UpdatedsysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions
UpdatedLikeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric valid
Updated- CVE-2026-65706: FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing 8.5 High
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation
Updated FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processe
UpdatedFFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value
UpdatedFFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() t
UpdatedVanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter subm
Updated- CVE-2026-65701: SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route 9.3 Critical
SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side path
Updated h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.p
UpdatedAgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and validate_task_count functions look up the target AgentRun using the client-supplied run_id without confirming the r
UpdatedVoid through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement a
UpdatedFathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript:
UpdatedOverseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the fil
UpdatedOffice-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_fi
UpdatedMicroweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive file
UpdatedMicroweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter('syst
Updated- CVE-2026-65690: Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload 8.7 High
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific
Updated - CVE-2026-65689: Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download 9.3 Critical
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full
Updated - CVE-2026-65688: Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing 9.3 Critical
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full u
Updated - CVE-2026-65687: Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing 9.3 Critical
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full un
Updated This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordNull pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.
UpdatedImproper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
UpdatedNo cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
UpdatedDeserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
UpdatedIncorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network.
UpdatedHeap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
UpdatedImproper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
UpdatedMissing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Updated