Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
22,396 matching · page 341/448Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2025-50166(opens NVD record) | Medium | 6.5 | Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network. | Aug 12, 2025 |
| CVE-2025-50165(opens NVD record) | Critical | 9.8 | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-50164(opens NVD record) | High | 8.0 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-50163(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-50162(opens NVD record) | High | 8.0 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-50161(opens NVD record) | High | 7.3 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-50160(opens NVD record) | High | 8.0 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-50159(opens NVD record) | High | 7.3 | Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-50158(opens NVD record) | High | 7.0 | Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally. | Aug 12, 2025 |
| CVE-2025-50157(opens NVD record) | Medium | 5.7 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. | Aug 12, 2025 |
| CVE-2025-50156(opens NVD record) | Medium | 5.7 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. | Aug 12, 2025 |
| CVE-2025-50155(opens NVD record) | High | 7.8 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-50154(opens NVD record) | Medium | 6.5 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. | Aug 12, 2025 |
| CVE-2025-50153(opens NVD record) | High | 7.8 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-49762(opens NVD record) | High | 7.0 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-49761(opens NVD record) | High | 7.8 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-49759(opens NVD record) | High | 8.8 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | Aug 12, 2025 |
| CVE-2025-49758(opens NVD record) | High | 8.8 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | Aug 12, 2025 |
| CVE-2025-49757(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-49755(opens NVD record) | Medium | 4.3 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. | Aug 12, 2025 |
| CVE-2025-49751(opens NVD record) | Medium | 6.8 | Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. | Aug 12, 2025 |
| CVE-2025-49745(opens NVD record) | Medium | 5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network. | Aug 12, 2025 |
| CVE-2025-49743(opens NVD record) | Medium | 6.7 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | Aug 12, 2025 |
| CVE-2025-49736(opens NVD record) | Medium | 4.3 | The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. | Aug 12, 2025 |
| CVE-2025-49712(opens NVD record) | High | 8.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Aug 12, 2025 |
| CVE-2025-49707(opens NVD record) | High | 7.9 | Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally. | Aug 12, 2025 |
| CVE-2025-48807(opens NVD record) | Medium | 6.7 | Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally. | Aug 12, 2025 |
| CVE-2025-47954(opens NVD record) | High | 8.8 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | Aug 12, 2025 |
| CVE-2025-33051(opens NVD record) | High | 7.5 | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. | Aug 12, 2025 |
| CVE-2025-25007(opens NVD record) | Medium | 5.3 | Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | Aug 12, 2025 |
| CVE-2025-25006(opens NVD record) | Medium | 5.3 | Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | Aug 12, 2025 |
| CVE-2025-25005(opens NVD record) | Medium | 6.5 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. | Aug 12, 2025 |
| CVE-2025-24999(opens NVD record) | High | 8.8 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | Aug 12, 2025 |
| CVE-2025-49568(opens NVD record) | Medium | 5.5 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Aug 12, 2025 |
| CVE-2025-49567(opens NVD record) | Medium | 5.5 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Aug 12, 2025 |
| CVE-2025-49564(opens NVD record) | High | 7.8 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Aug 12, 2025 |
| CVE-2025-49563(opens NVD record) | High | 7.8 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Aug 12, 2025 |
| CVE-2025-8310(opens NVD record) | Medium | 6.5 | Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password | Aug 12, 2025 |
| CVE-2025-8297(opens NVD record) | High | 7.2 | Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution | Aug 12, 2025 |
| CVE-2025-8296(opens NVD record) | High | 7.2 | SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution | Aug 12, 2025 |
| CVE-2025-5468(opens NVD record) | Medium | 5.5 | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk. | Aug 12, 2025 |
| CVE-2025-5466(opens NVD record) | Medium | 4.9 | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service | Aug 12, 2025 |
| CVE-2025-5462(opens NVD record) | High | 7.5 | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. | Aug 12, 2025 |
| CVE-2025-5456(opens NVD record) | High | 7.5 | A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125 | Aug 12, 2025 |
| CVE-2025-3831(opens NVD record) | High | 8.1 | Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. | Aug 12, 2025 |
| CVE-2025-26398(opens NVD record) | Medium | 5.6 | SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host. | Aug 12, 2025 |
| CVE-2025-8852(opens NVD record) | Medium | 4.3 | A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | Aug 11, 2025 |
| CVE-2025-8661(opens NVD record) | Medium | 6.1 | A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user. | Aug 11, 2025 |
| CVE-2025-8660(opens NVD record) | Critical | 9.8 | Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed. | Aug 11, 2025 |
| CVE-2025-8732(opens NVD record) | Low | 3.3 | A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." | Aug 8, 2025 |