Vulnerability intelligence / live index
A working index of published vulnerability records, ordered by latest update. Open a record to inspect its score, vector, and impact metrics.
CVE Program / CVE List®
Updated continuously
Nov 12, 2026 UTC
SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. At…
Inspect record →Nov 12, 2026 UTC
An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast …
Inspect record →Nov 12, 2026 UTC
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate l…
Inspect record →Nov 12, 2026 UTC
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB table schemas across workspace boundaries and export app definitions across granular permission boundar…
Inspect record →Nov 12, 2026 UTC
Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane soc…
Inspect record →Nov 12, 2026 UTC
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email…
Inspect record →Nov 12, 2026 UTC
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Inspect record →Nov 12, 2026 UTC
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Inspect record →Nov 12, 2026 UTC
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Inspect record →Nov 12, 2026 UTC
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Inspect record →Nov 12, 2026 UTC
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Inspect record →Nov 12, 2026 UTC
Product ui does not warn user of unsafe actions in Microsoft Office allows an unauthorized attacker to bypass a security feature over a network.
Inspect record →Nov 12, 2026 UTC
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
Inspect record →Nov 12, 2026 UTC
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Inspect record →Nov 12, 2026 UTC
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Inspect record →
