Filtered by vendor Subscriptions
Total 332769 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-7195 1 Redhat 13 Acm, Advanced Cluster Security, Apicurio Registry and 10 more 2026-02-14 5.2 Medium
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVE-2026-1731 1 Beyondtrust 2 Privileged Remote Access, Remote Support 2026-02-14 N/A
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
CVE-2026-24853 2026-02-14 8.1 High
Caido is a web security auditing toolkit. Prior to 0.55.0, Caido blocks non whitelisted domains to reach out through the 8080 port, and shows Host/IP is not allowed to connect to Caido on all endpoints. But this is bypassable by injecting a X-Forwarded-Host: 127.0.0.1:8080 header. This vulnerability is fixed in 0.55.0.
CVE-2025-9293 2 Tp-link, Tp Link 14 Aginet App, Deco App, Festa App and 11 more 2026-02-14 N/A
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
CVE-2025-9292 1 Tp-link 1 Omada Cloud Controller 2026-02-14 N/A
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
CVE-2025-55338 1 Microsoft 26 Bitlocker, Windows, Windows 10 and 23 more 2026-02-14 6.1 Medium
Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVE-2025-59213 1 Microsoft 4 Configuration Manager, Configuration Manager 2403, Configuration Manager 2409 and 1 more 2026-02-14 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.
CVE-2025-60711 1 Microsoft 1 Edge Chromium 2026-02-14 6.3 Medium
Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2025-59501 1 Microsoft 4 Configuration Manager, Configuration Manager 2403, Configuration Manager 2409 and 1 more 2026-02-14 4.8 Medium
Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.
CVE-2025-59500 1 Microsoft 2 Azure, Azure Notification Service 2026-02-14 7.7 High
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
CVE-2025-59503 1 Microsoft 2 Azure, Azure Compute Resource Provider 2026-02-14 10 Critical
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-59273 1 Microsoft 3 Azure, Azure Event Grid, Azure Event Grid System 2026-02-14 7.3 High
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-59286 1 Microsoft 4 365, 365 Copilot, 365 Copilot Business Chat and 1 more 2026-02-14 9.3 Critical
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-55321 1 Microsoft 1 Azure Monitor 2026-02-14 9.3 Critical
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-59272 1 Microsoft 4 365, 365 Copilot, 365 Copilot Business Chat and 1 more 2026-02-14 9.3 Critical
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.
CVE-2025-59271 1 Microsoft 3 Azure Cache For Redis, Azure Cache For Redis Enterprise, Azure Managed Redis 2026-02-14 8.7 High
Redis Enterprise Elevation of Privilege Vulnerability
CVE-2025-59252 1 Microsoft 3 365, 365 Copilot, 365 Word Copilot 2026-02-14 9.3 Critical
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-59247 1 Microsoft 2 Azure, Azure Playfab 2026-02-14 8.8 High
Azure PlayFab Elevation of Privilege Vulnerability
CVE-2025-59246 1 Microsoft 2 Entra Id, Microsoft Entra Id 2026-02-14 9.8 Critical
Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-59218 1 Microsoft 2 Entra Id, Microsoft Entra Id 2026-02-14 9.6 Critical
Azure Entra ID Elevation of Privilege Vulnerability