All CVEs — page 153 of 242

The complete archive, 25 per page, newest first. 6034 records. Search instead.

• MEDIUM 4.1CVE-2026-61681public exploit available2026-09-21

  The flaw allows an authenticated user to replace the UnsubscribeURL with an internal URL, leading to potential exposure of sensitive data and credentials.

• UNSCOREDCVE-2026-55563public exploit available2026-09-21
• HIGH 8.8CVE-2026-53940public exploit available2026-09-21

  The flaw allows a malicious package to write an executable wrapper outside the intended directory or overwrite another entry point, leading to potential code execution with the installing user's privileges.

• MEDIUM 5.2CVE-2026-36472public exploit available2026-09-21

  The flaw allows a remote attacker to inject arbitrary JavaScript into an authenticated user's session via unsanitized clickable links on the msg_info page, leading to potential data theft or manipulation.

• MEDIUM 5.8CVE-2026-36471public exploit available2026-09-21
• MEDIUM 5.8CVE-2026-36470public exploit available2026-09-21
• CRITICAL 9.1CVE-2026-36469public exploit available2026-09-21

  CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) allowing attackers to forge requests and potentially access internal services or networks.

• MEDIUM 6.1CVE-2026-36468public exploit available2026-09-21

  The flaw is a cross-site scripting (XSS) vulnerability in CuteNews v.2.1.2 that allows remote unauthenticated attackers to inject malicious scripts via URL parameters, potentially leading to information disclosure or user manipulation.

• HIGH 7.2CVE-2026-36467public exploit available2026-09-21

  This vulnerability allows remote authenticated users to execute arbitrary code by uploading a file with a dangerous type, leading to potential remote server access.

• CRITICAL 9.8CVE-2026-943012026-09-21

  This flaw allows for an allow-list bypass via java.lang.reflect.Proxy, enabling unauthorized access. It matters because it can lead to remote code execution or data leakage.

• HIGH 8.1CVE-2026-941842026-09-21

  The flaw is a stack-based buffer overflow in fetchmail when NTLM support is enabled, allowing a malicious server to potentially execute arbitrary code or cause service disruption.

• MEDIUM 5.4CVE-2026-933392026-09-21

  The flaw allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values, leading to cross-site scripting attacks.

• CRITICAL 9.1CVE-2026-86473public exploit available2026-09-21

  The flaw allows an attacker to maintain access to an Apache Airflow instance after a user logs out, as the logout endpoint does not revoke the token when presented via an Authorization header, leaving the token valid for up to 24 hours.

• MEDIUM 4.2CVE-2026-82355public exploit available2026-09-21

  This vulnerability allows an attacker to bypass intended authentication by using a session cookie and an explicit bearer token, with Airflow resolving the caller from the cookie instead of the token.

• HIGH 8.1CVE-2026-801102026-09-21

  The flaw in pki-core allows wildcard ACL permissions to override more specific literal permissions, potentially enabling unauthorized access to certificate management functions.

• HIGH 7.4CVE-2026-759392026-09-21

  The flaw in openshift/oc-mirror allows for PGP signature verification bypass, enabling remote attackers to forge signatures and mirror malicious release payloads into a disconnected registry.

• MEDIUM 4.3CVE-2026-75158public exploit available2026-09-21

  The flaw allows any authenticated user with asset-read access to enumerate asset events for all Dags in the deployment, including those they are not authorized to see, due to missing access control filters.

• UNSCOREDCVE-2026-71543public exploit available2026-09-21
• UNSCOREDCVE-2026-68919public exploit available2026-09-21
• MEDIUM 4.2CVE-2026-61630public exploit available2026-09-21

  The flaw allows any user with OTP 2FA enabled to reuse their TOTP during a 30-second window, potentially leading to unauthorized access.

• HIGH 7.5CVE-2026-61629public exploit available2026-09-21

  The flaw allows unauthenticated attackers to perform a denial of service (DoS) by sending specially crafted requests that consume excessive CPU resources.

• HIGH 8.1CVE-2026-61628public exploit available2026-09-21

  The flaw allows unauthenticated attackers to create a full admin account by exploiting a race condition in the onboarding process.

• UNSCOREDCVE-2026-55870public exploit available2026-09-21
• MEDIUM 4.9CVE-2026-55625public exploit available2026-09-21

  The flaw allows pipeline group administrators to test connections for source control materials outside their authorized scope, potentially exposing credentials. It also enables resolution of external secrets managed by secret-management plugins.

• HIGH 7.8CVE-2026-55567public exploit available2026-09-21

  The flaw allows a local unprivileged user to replace a target directory with a Windows junction and symlink, enabling arbitrary privileged file deletion which can lead to SYSTEM privileges.