Filtered by vendor Subscriptions
Total 333165 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-7195 1 Redhat 13 Acm, Advanced Cluster Security, Apicurio Registry and 10 more 2026-02-18 5.2 Medium
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVE-2026-23599 2026-02-18 7.8 High
A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.
CVE-2026-22048 2026-02-18 7.1 High
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.
CVE-2026-1344 1 Tanium 1 Service Enforce Recovery-key-portal 2026-02-18 6.5 Medium
Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal.
CVE-2026-2441 4 Apple, Google, Linux and 1 more 4 Macos, Chrome, Linux Kernel and 1 more 2026-02-18 8.8 High
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2008-0015 1 Microsoft 2 Windows 2003 Server, Windows Xp 2026-02-18 8.8 High
Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."
CVE-2024-7694 1 Teamt5 1 Threatsonar Anti-ransomware 2026-02-18 7.2 High
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.
CVE-2020-7796 1 Synacor 1 Zimbra Collaboration Suite 2026-02-18 9.8 Critical
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
CVE-2026-2570 2026-02-18 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2026-26119 1 Microsoft 1 Windows Admin Center 2026-02-18 8.8 High
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
CVE-2026-1670 2026-02-18 9.8 Critical
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
CVE-2025-62183 2026-02-18 N/A
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality and Integrity are low.
CVE-2025-13689 1 Ibm 1 Datastage On Cloud Pak 2026-02-18 8.8 High
IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads.
CVE-2025-13333 1 Ibm 1 Websphere Application Server 2026-02-18 4.4 Medium
IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.
CVE-2026-20841 1 Microsoft 2 Window Notepad, Windows Notepad 2026-02-18 7.8 High
Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.
CVE-2026-20846 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-02-18 7.5 High
Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
CVE-2026-21222 1 Microsoft 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more 2026-02-18 5.5 Medium
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
CVE-2026-21228 1 Microsoft 1 Azure Local 2026-02-18 8.1 High
Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.
CVE-2026-21231 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-02-18 7.8 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-21232 1 Microsoft 14 Windows 11 22h3, Windows 11 23h2, Windows 11 23h2 and 11 more 2026-02-18 7.8 High
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.