All CVEs — page 432 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• HIGH 7.5CVE-2026-96280public exploit available2026-09-27

  A heap buffer overflow occurs in the OCI delta stream parser when processing large file sizes on 32-bit systems, where 64-bit size values are incorrectly truncated to 32-bit allocations, leading to potential code execution. This affects flatpak installations and updates when interacting with OCI registries.

• CRITICAL 9.8CVE-2026-101090public exploit available2026-09-27

  The flaw allows an attacker to inject a Host header, leading to a redirect_uri that can be controlled, potentially enabling unauthorized account access.

• LOW 3.1CVE-2026-101089public exploit available2026-09-27
• MEDIUM 5.3CVE-2026-101088public exploit available2026-09-27
• MEDIUM 4.3CVE-2026-101087public exploit available2026-09-27
• MEDIUM 6.5CVE-2026-101086public exploit available2026-09-27
• MEDIUM 6.5CVE-2026-101085public exploit available2026-09-27
• CRITICAL 9.6CVE-2026-101084public exploit available2026-09-27

  The flaw allows any authenticated user to connect to restricted MCP servers by possessing the server ID, bypassing authorization checks and accessing sensitive backend systems.

• CRITICAL 9.8CVE-2026-101065public exploit available2026-09-27

  The flaw allows unauthenticated access to the Obot API and UI, granting full administrative control to any party who can reach the exposed port.

• HIGH 7.6CVE-2026-101064public exploit available2026-09-27

  Obot before v0.23.0 allows attackers with Power User or higher roles to register remote MCP servers and make requests to internal services, potentially disclosing sensitive credentials.

• MEDIUM 5.3CVE-2026-101063public exploit available2026-09-27
• HIGH 8.8CVE-2026-101062public exploit available2026-09-27

  The flaw allows an attacker to register an OAuth client without authentication, leading to unauthorized access to the victim's resources via a crafted authorization URL.

• LOW 3.5CVE-2026-100880public exploit available2026-09-27
• MEDIUM 4.3CVE-2026-100879public exploit available2026-09-27
• MEDIUM 6.3CVE-2026-100878public exploit available2026-09-27
• MEDIUM 4.3CVE-2026-100877public exploit available2026-09-27
• MEDIUM 6.5CVE-2026-96279public exploit available2026-09-27
• MEDIUM 6.3CVE-2026-100876public exploit available2026-09-27
• HIGH 7.3CVE-2026-100875public exploit available2026-09-27
• HIGH 7.3CVE-2026-100874public exploit available2026-09-27
• MEDIUM 4.3CVE-2026-100873public exploit available2026-09-27
• MEDIUM 4.7CVE-2026-101061public exploit available2026-09-27
• HIGH 8.2CVE-2026-101060public exploit available2026-09-27

  The vulnerability allows attackers to forge server-side requests, potentially accessing internal services or cloud metadata endpoints.

• HIGH 7.1CVE-2026-101059public exploit available2026-09-27
• MEDIUM 6.9CVE-2026-101058public exploit available2026-09-27