All CVEs — page 1105 of 1220

The complete archive, 25 per page, newest first. 30483 records. Search instead.

• MEDIUM 6.3CVE-2026-95930public exploit available2026-09-23
• MEDIUM 6.3CVE-2026-95929public exploit available2026-09-23
• HIGH 7.5CVE-2026-91777public exploit available2026-09-23

  The flaw allows attackers to cause quadratic CPU consumption during JSON deserialization when processing collections or maps with @JsonIdentityInfo enabled. This happens when objects are referenced before they're defined, leading to excessive identity comparisons that grow exponentially with input size.

• HIGH 7.5CVE-2026-91776public exploit available2026-09-23

  The flaw allows attackers to cause unbounded memory growth by repeatedly supplying unique unknown type IDs in JSON deserialization, leading to memory exhaustion. This occurs when applications use name-based polymorphism with fallback deserializers and reuse ObjectMapper instances across requests.

• HIGH 7.5CVE-2026-89425public exploit available2026-09-23

  The flaw allows attackers to trigger unbounded memory growth through malformed JSON tokens when using DataInput-based parsing, leading to potential OutOfMemoryError and system instability. This affects FasterXML jackson-core versions 2.8.0 and later where UTF8DataInputJsonParser was introduced.

• MEDIUM 5.5CVE-2026-95928public exploit available2026-09-23
• HIGH 7.3CVE-2026-95927public exploit available2026-09-23
• HIGH 7.3CVE-2026-95926public exploit available2026-09-23
• MEDIUM 5.5CVE-2026-96273public exploit available2026-09-23
• HIGH 7.5CVE-2026-96272public exploit available2026-09-23

  ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint that allows unauthenticated attackers to extract user credentials and admin password hashes through time-based blind SQL injection techniques, enabling account takeover.

• HIGH 7.1CVE-2026-96271public exploit available2026-09-23
• HIGH 7.3CVE-2026-95925public exploit available2026-09-23
• HIGH 7.3CVE-2026-95924public exploit available2026-09-23
• MEDIUM 5.5CVE-2026-95897public exploit available2026-09-23
• MEDIUM 6.3CVE-2026-95868public exploit available2026-09-23
• MEDIUM 6.3CVE-2026-95833public exploit available2026-09-23
• MEDIUM 6.3CVE-2026-95830public exploit available2026-09-23
• MEDIUM 6.3CVE-2026-95829public exploit available2026-09-23
• HIGH 7.2CVE-2026-943672026-09-23
• MEDIUM 6.2CVE-2026-929302026-09-23
• MEDIUM 5.3CVE-2026-929292026-09-23
• MEDIUM 6.5CVE-2026-929282026-09-23
• MEDIUM 4.3CVE-2026-95828public exploit available2026-09-22
• MEDIUM 6.3CVE-2026-95820public exploit available2026-09-22
• HIGH 7.5CVE-2026-61685public exploit available2026-09-22

  ReactPress allows unauthenticated attackers to inject SQL through API endpoints by using unsanitized HTTP query parameter names as SQL column identifiers, potentially leading to unauthorized data access.