All CVEs — page 373 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• UNSCOREDCVE-2026-103548public exploit available2026-09-30
• UNSCOREDCVE-2026-103547public exploit available2026-09-30
• MEDIUM 4.3CVE-2026-103387public exploit available2026-09-30
• HIGH 7.5CVE-2026-102994public exploit available2026-09-30

  The pypdf library suffers from a denial-of-service vulnerability where specially crafted PDF files can cause excessive CPU and memory consumption during parsing, leading to application unavailability. This occurs when PDF files contain long sequences of indirect-object identifiers or generation numbers without whitespace, causing the parser to scan indefinitely.

• HIGH 7.5CVE-2026-102993public exploit available2026-09-30

  A crafted PDF file can cause pypdf to generate excessively large numeral strings when retrieving page labels, leading to high memory consumption and potential application unavailability. This vulnerability affects applications using pypdf to process PDFs.

• UNSCOREDCVE-2026-102992public exploit available2026-09-30
• MEDIUM 6.5CVE-2026-102991public exploit available2026-09-30
• UNSCOREDCVE-2026-102990public exploit available2026-09-30
• HIGH 7.8CVE-2026-101885public exploit available2026-09-30

  ZeroClaw versions before 0.8.5 with the plugins-wasm feature allow attackers to install crafted plugins that can write arbitrary files to paths outside the plugins directory, leading to potential code execution.

• HIGH 7.5CVE-2026-101884public exploit available2026-09-30

  The flaw is an incomplete environment variable sanitizer in OpenClaw Windows Node that fails to block critical variables like GIT_CONFIG_* and DOTNET_STARTUP_HOOKS, allowing attackers with gateway or agent access to inject malicious code into allowed tools like git, dotnet, and java, leading to arbitrary code execution.

• MEDIUM 5.4CVE-2026-101883public exploit available2026-09-30
• HIGH 8.8CVE-2026-101882public exploit available2026-09-30

  The flaw in OpenClaw Windows Node allows remote attackers to execute arbitrary commands by exploiting incomplete validation in system.execApprovals.set, potentially leading to full system compromise.

• MEDIUM 6.5CVE-2026-101881public exploit available2026-09-30
• HIGH 8.8CVE-2026-101880public exploit available2026-09-30

  The flaw in OpenClaw Windows Node before 2026.7.1 allows attackers to bypass approval rules by using pipe operators or command substitution, leading to arbitrary command execution.

• MEDIUM 6.5CVE-2026-101879public exploit available2026-09-30
• HIGH 8.8CVE-2026-972912026-09-30

  The flaw allows for PHP object injection, enabling attackers to execute arbitrary code, leading to potential data loss and system compromise.

• HIGH 7.1CVE-2026-972902026-09-30
• MEDIUM 6.5CVE-2026-972652026-09-30
• HIGH 7.2CVE-2026-972562026-09-30
• HIGH 7.1CVE-2026-941712026-09-30
• HIGH 8.1CVE-2026-87004public exploit available2026-09-30

  The flaw allows an attacker to bypass security checks by decoding an OIDC id_token without verifying its signature or critical claims, potentially leading to unauthorized access.

• UNSCOREDCVE-2026-55224public exploit available2026-09-30
• CRITICAL 10CVE-2026-55107public exploit available2026-09-30

  Kobako Ruby gem versions before 0.9.1 allow guest mruby scripts to escape the sandbox and execute arbitrary Ruby code in the host process, leading to remote code execution.

• UNSCOREDCVE-2026-55094public exploit available2026-09-30
• HIGH 7.8CVE-2026-53605public exploit available2026-09-30

  The flaw allows the pollen daemon user to gain full root access with passwordless sudo, enabling local privilege escalation.