All CVEs — page 338 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• CRITICAL 9.8CVE-2026-82042public exploit available2026-10-02

  UTMStack before 11.2.16 allows remote attackers to bypass authentication by using a valid Utm-Internal-Key header, gaining full administrative API access.

• CRITICAL 9.9CVE-2026-82041public exploit available2026-10-02

  This vulnerability allows any authenticated user to execute arbitrary commands on connected agents, posing a significant risk due to the lack of role-based authorization checks.

• UNSCOREDCVE-2026-759372026-10-02
• MEDIUM 5.3CVE-2026-104874public exploit available2026-10-02
• UNSCOREDCVE-2026-104055public exploit available2026-10-02
• MEDIUM 5CVE-2026-82040public exploit available2026-10-02
• HIGH 8.8CVE-2026-82039public exploit available2026-10-02

  This vulnerability allows authenticated attackers to inject arbitrary SQL, enabling full database access and potential filesystem access, due to unsanitized input in the UTMStack asset management feature.

• HIGH 8.8CVE-2026-397182026-10-02

  A Cross-Site Request Forgery (CSRF) vulnerability exists in Webriti Wallstreet wallstreet versions from n/a through 2.8.6, allowing attackers to forge requests and perform unauthorized actions on behalf of authenticated users.

• MEDIUM 5.3CVE-2026-12392public exploit available2026-10-02
• LOW 2.5CVE-2026-104994public exploit available2026-10-02
• HIGH 7.1CVE-2026-104991public exploit available2026-10-02
• HIGH 8.1CVE-2026-1049882026-10-02

  The CMCAuthForEST authentication plugin in Dogtag PKI fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate, allowing an authenticated user to obtain CA-signed certificates with arbitrary subject names.

• UNSCOREDCVE-2026-104873public exploit available2026-10-02
• MEDIUM 5.8CVE-2026-104872public exploit available2026-10-02
• UNSCOREDCVE-2026-104871public exploit available2026-10-02
• CRITICAL 9CVE-2026-104019public exploit available2026-10-02

  The flaw allows an authenticated remote user to execute arbitrary commands in another project member's Studio Space, potentially leading to credential theft.

• MEDIUM 6.5CVE-2026-103918public exploit available2026-10-02
• MEDIUM 6.5CVE-2026-103036public exploit available2026-10-02
• HIGH 8.8CVE-2026-969402026-10-02

  A weakness in Microsoft Exchange Server's authorization mechanism allows authenticated attackers to escalate their privileges, posing a significant security risk.

• MEDIUM 6.5CVE-2026-198562026-10-02
• HIGH 7.6CVE-2026-103958public exploit available2026-10-02

  An authenticated attacker can exploit a server-side request forgery vulnerability in Loom for AWS to access internal network resources and potentially obtain container credentials. This allows lateral movement and data exfiltration within the internal network.

• MEDIUM 6.2CVE-2026-103957public exploit available2026-10-02
• CRITICAL 10CVE-2026-103956public exploit available2026-10-02

  The flaw allows remote actors to gain super-admin authority by exploiting missing authentication in the Loom for AWS application API before version 1.6.1.

• CRITICAL 9.8CVE-2023-54405public exploit available2026-10-02

  This vulnerability allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution.

• HIGH 7.5CVE-2020-37278public exploit available2026-10-02

  Weaver e-Bridge suffers from an unauthenticated arbitrary file read vulnerability that allows remote attackers to access sensitive files on the host system and potentially perform server-side request forgery against internal resources.