All CVEs — page 1108 of 1220

The complete archive, 25 per page, newest first. 30483 records. Search instead.

• MEDIUM 6.3CVE-2026-95815public exploit available2026-09-22
• HIGH 8.1CVE-2026-95814public exploit available2026-09-22

  The flaw allows revoked or not-yet-confirmed Vaultwarden members to retain access to organization ciphers, potentially exposing sensitive data.

• MEDIUM 6.1CVE-2026-95813public exploit available2026-09-22
• MEDIUM 6.1CVE-2026-95812public exploit available2026-09-22
• HIGH 7.5CVE-2026-94450public exploit available2026-09-22

  The s2n-quic library fails to properly validate the length of Destination Connection IDs, allowing remote attackers to trigger a server endpoint shutdown with a single malicious UDP packet. This creates a high-impact denial-of-service condition affecting only servers configured to send Retry packets.

• HIGH 8.8CVE-2026-91018public exploit available2026-09-22

  The lwIP library contains a double free vulnerability that could lead to system crashes, denial of service, memory corruption, or code execution.

• UNSCOREDCVE-2026-890192026-09-22
• MEDIUM 6.1CVE-2026-88020public exploit available2026-09-22
• UNSCOREDCVE-2026-77987public exploit available2026-09-22
• UNSCOREDCVE-2026-77912public exploit available2026-09-22
• UNSCOREDCVE-2026-77426public exploit available2026-09-22
• MEDIUM 4.3CVE-2026-77425public exploit available2026-09-22
• UNSCOREDCVE-2026-76910public exploit available2026-09-22
• UNSCOREDCVE-2026-76909public exploit available2026-09-22
• UNSCOREDCVE-2026-75101public exploit available2026-09-22
• HIGH 8.8CVE-2026-67615public exploit available2026-09-22

  This vulnerability allows authenticated non-guest users to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint, leading to remote code execution.

• LOW 2.3CVE-2026-62364public exploit available2026-09-22
• HIGH 7.8CVE-2026-945742026-09-22

  A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a writable configuration file path, allowing unprivileged users to execute arbitrary code and potentially escalate local privileges.

• CRITICAL 9.1CVE-2026-892822026-09-22

  The flaw allows authenticated users to write to the default install directory, posing a risk of unauthorized code execution or data modification.

• HIGH 8.4CVE-2026-892812026-09-22

  This vulnerability allows local code execution due to a hardcoded path in the openssl.cnf configuration file within the Apache Lounge Windows distribution of Apache HTTP Server.

• CRITICAL 9.1CVE-2026-88624public exploit available2026-09-22

  This vulnerability allows attackers to execute arbitrary recursive directory deletion by exploiting missing path validation in the Worktree.remove component of openCode v1.18.26, posing a critical risk to system integrity.

• HIGH 8.8CVE-2026-88419public exploit available2026-09-22

  The flaw allows an authenticated low-privileged user to upload a .php file, leading to arbitrary code execution on the server due to lack of proper file extension validation and content checks.

• HIGH 8.8CVE-2026-88418public exploit available2026-09-22

  CMSimple 5.24 lacks CSRF protection, allowing unauthenticated attackers to inject and execute arbitrary PHP code via specially crafted content-save requests.

• UNSCOREDCVE-2026-88416public exploit available2026-09-22
• UNSCOREDCVE-2026-88350public exploit available2026-09-22