8440 matches found
CVE-2026-50124 DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where...
CVE-2026-59236
Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...
CVE-2026-59236
Roskus Prospero Flow CRM (pre-5.14.0) is affected by CVE-2026-59236: Authorization bypass in Excel import handlers (CustomerImport, LeadImport, ProductImport). A remote, authenticated user can inject records into another tenant by supplying a spreadsheet with a company_id pointing to the victim t...
CVE-2026-59236 Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...
CVE-2026-59236 Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...
EUVD-2026-44622
Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...
CVE-2026-59236
Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...
Security Updates for Microsoft Office Products (July 2026) (macOS)
The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the july-14-2026 advisory. - Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2026-55045 - Stack-based buffer overflow i...
CVE-2026-55949
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-56156
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-55947
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-55898
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
CVE-2026-55141
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-55136
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-55137
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-55138
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
CVE-2026-55131
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
CVE-2026-55122
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...