Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424296 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424296 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69134 | 1 Suitecrm | 1 Suitecrm | 2026-11-10 | 8.8 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. The affected flow begins at $GLOBALS['RAW_REQUEST'] and uses set_relationship, SugarRelationship::addRow(), SugarRelationship::updateRow(), and contact_role to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can inject SQL through relationship fields to read or alter database data and may reach file-write consequences when the database account has elevated privileges. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-100358 | 1 Suitecrm | 1 Suitecrm | 2026-11-10 | 9.1 Critical |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-100359 | 1 Suitecrm | 1 Suitecrm | 2026-11-10 | 6.5 Medium |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-100360 | 1 Suitecrm | 1 Suitecrm | 2026-11-10 | 5.4 Medium |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-120003 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120002 | 1 Microsoft | 1 Sharepoint Server | 2026-11-10 | 9.9 Critical |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-120001 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-120000 | 1 Microsoft | 1 Sharepoint Server | 2026-11-10 | 7.5 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-119999 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-119998 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-10 | 6.5 Medium |
| Product ui does not warn user of unsafe actions in Microsoft Office allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-119997 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-119996 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-10 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119995 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-10 | 7.5 High |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-119993 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-11-10 | 6.5 Medium |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-118732 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118731 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118730 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-100361 | 1 Suitecrm | 1 Suitecrm | 2026-11-10 | 7.1 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-118729 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 8.8 High |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-118728 | 1 Microsoft | 6 365 Apps, Office 2021, Office 2024 and 3 more | 2026-11-10 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||