CVEs.

Matching CVEs

1. 7.8High

   CVE-2026-0662 ↗ (opens in a new tab)

   A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

   AUAutodesk· Feb 4, 2026

2. 8.4High

   CVE-2026-0661 ↗ (opens in a new tab)

   A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

   AUAutodesk· Feb 4, 2026

3. 8.4High

   CVE-2026-0660 ↗ (opens in a new tab)

   A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

   AUAutodesk· Feb 4, 2026

4. 7.8High

   CVE-2026-0659 ↗ (opens in a new tab)

   A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

   AUAutodesk· Feb 4, 2026

5. 8.4High

   CVE-2026-0538 ↗ (opens in a new tab)

   A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

   AUAutodesk· Feb 4, 2026

6. 8.4High

   CVE-2026-0537 ↗ (opens in a new tab)

   A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

   AUAutodesk· Feb 4, 2026

7. 7.7High

   CVE-2026-24887 ↗ (opens in a new tab)

   Claude Code is an agentic coding tool. Prior to version 2.0.72, due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.72.

   ANAnthropic (Claude)· Feb 3, 2026

8. 7.7High

   CVE-2026-24053 ↗ (opens in a new tab)

   Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass directory restrictions and write files outside the current working directory without user permission prompts. Exploiting this required the user to use ZSH and the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.74.

   ANAnthropic (Claude)· Feb 3, 2026

9. 7.1High

   CVE-2026-24052 ↗ (opens in a new tab)

   Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version

   ANAnthropic (Claude)· Feb 3, 2026

10. 7.8High

    CVE-2026-24149 ↗ (opens in a new tab)

    NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering.

    NVNVIDIA· Feb 3, 2026

11. 7.5High

    CVE-2026-23569 ↗ (opens in a new tab)

    An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows a remote attacker to leak stack memory and cause a denial of service via a crafted request. The leaked stack memory could be used to bypass ASLR remotely and facilitate exploitation of other vulnerabilities on the affected system.

    TETeamViewer· Jan 29, 2026

12. 8.1High

    CVE-2026-23568 ↗ (opens in a new tab)

    An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause information disclosure or denial-of-service via a special crafted packet. The leaked memory could be used to bypass ASLR and facilitate further exploitation.

    TETeamViewer· Jan 29, 2026

13. 7.1High

    CVE-2026-23563 ↗ (opens in a new tab)

    Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system files via a crafted RPC control junction or symlink that is followed when the delete instruction executes.

    TETeamViewer· Jan 29, 2026

14. 8.1High

    CVE-2025-14472 ↗ (opens in a new tab)

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.

    ACAcquia· Jan 28, 2026

15. 7.8High

    CVE-2025-33220 ↗ (opens in a new tab)

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

    NVNVIDIA· Jan 28, 2026

16. 7.8High

    CVE-2025-33219 ↗ (opens in a new tab)

    NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wraparound. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

    NVNVIDIA· Jan 28, 2026

17. 7.8High

    CVE-2025-33218 ↗ (opens in a new tab)

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

    NVNVIDIA· Jan 28, 2026

18. 7.8High

    CVE-2025-33217 ↗ (opens in a new tab)

    NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Jan 28, 2026

19. 7.8High

    CVE-2025-57283 ↗ (opens in a new tab)

    The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

    BRBrowserStack· Jan 28, 2026

20. 7.8High

    CVE-2025-33234 ↗ (opens in a new tab)

    NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Jan 27, 2026

21. 7.1High

    CVE-2025-14911 ↗ (opens in a new tab)

    User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

    MAMongoDB Atlas· Jan 27, 2026

22. 8.1High

    CVE-2026-21721 ↗ (opens in a new tab)

    The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

    GCGrafana Cloud· Jan 27, 2026

23. 7.5High

    CVE-2026-21720 ↗ (opens in a new tab)

    Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.

    GCGrafana Cloud· Jan 27, 2026

24. 7.5High

    CVE-2025-59472 ↗ (opens in a new tab)

    A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust ava

    VEVercel· Jan 26, 2026

25. 7.5High

    CVE-2025-59471 ↗ (opens in a new tab)

    A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrad

    VEVercel· Jan 26, 2026

26. 7.8High

    CVE-2026-21509 ↗ (opens in a new tab)Known exploited

    Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

    M3Microsoft 365· Jan 26, 2026

27. 7.4High

    CVE-2026-21524 ↗ (opens in a new tab)

    Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.

    MAMicrosoft Azure· Jan 22, 2026

28. 7.5High

    CVE-2026-21520 ↗ (opens in a new tab)

    Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

    M3Microsoft 365· Jan 22, 2026

29. 8.1High

    CVE-2026-0535 ↗ (opens in a new tab)

    A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

    AUAutodesk· Jan 22, 2026

30. 8.1High

    CVE-2026-0534 ↗ (opens in a new tab)

    A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

    AUAutodesk· Jan 22, 2026

31. 8.1High

    CVE-2026-0533 ↗ (opens in a new tab)

    A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

    AUAutodesk· Jan 22, 2026

32. 7.5High

    CVE-2026-1102 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending repeated malformed SSH authentication requests.

    GIGitLab· Jan 22, 2026

33. 7.4High

    CVE-2026-0723 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

    GIGitLab· Jan 22, 2026

34. 7.5High

    CVE-2025-13928 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

    GIGitLab· Jan 22, 2026

35. 7.5High

    CVE-2025-13927 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

    GIGitLab· Jan 22, 2026

36. 7.7High

    CVE-2026-0933 ↗ (opens in a new tab)

    SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler. Root causeThe commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metac

    CLCloudflare· Jan 20, 2026

37. 7.8High

    CVE-2025-33233 ↗ (opens in a new tab)

    NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Jan 20, 2026

38. 7.3High

    CVE-2025-33230 ↗ (opens in a new tab)

    NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation of privileges, code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Jan 20, 2026

39. 7.3High

    CVE-2025-33229 ↗ (opens in a new tab)

    NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the NVIDIA Nsight Visual Studio Edition Monitor application. A successful exploit of this vulnerability may lead to escalation of privileges, code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Jan 20, 2026

40. 7.3High

    CVE-2025-33228 ↗ (opens in a new tab)

    NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Jan 20, 2026

41. 7.5High

    CVE-2025-14844 ↗ (opens in a new tab)

    The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.

    LWLiquid Web· Jan 16, 2026

42. 8.2High

    CVE-2025-67823 ↗ (opens in a new tab)

    A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction where the email channel is enabled. This could allow an attacker to execute arbitrary scripts in the victim's browser or desktop client application.

    MIMitel· Jan 15, 2026

43. 7.8High

    CVE-2025-33206 ↗ (opens in a new tab)

    NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

    NVNVIDIA· Jan 14, 2026

44. 7.2High

    CVE-2026-22708 ↗ (opens in a new tab)

    Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via indirect or direct prompt injection to poison the shell environment by setting, modifying, or removing environment variables that influence trusted commands. This vulnerability is fixed in 2.3.

    CUCursor· Jan 14, 2026

45. 8.6High

    CVE-2026-0532 ↗ (opens in a new tab)

    External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

    ECElastic Cloud· Jan 14, 2026

46. 8.7High

    CVE-2026-22871 ↗ (opens in a new tab)

    GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. This vulnerability is fixed in 2.7.1.

    DADatadog· Jan 13, 2026

47. 7.1High

    CVE-2026-22870 ↗ (opens in a new tab)

    GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.

    DADatadog· Jan 13, 2026

48. 7.5High

    CVE-2026-0528 ↗ (opens in a new tab)

    Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

    ECElastic Cloud· Jan 13, 2026

49. 7.5High

    CVE-2026-21226 ↗ (opens in a new tab)

    Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.

    MAMicrosoft Azure· Jan 13, 2026

50. 7.8High

    CVE-2026-21224 ↗ (opens in a new tab)

    Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

    MAMicrosoft Azure· Jan 13, 2026