All CVEs — page 436 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• HIGH 8CVE-2026-100857public exploit available2026-09-27

  The flaw allows authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code, leading to potential code execution as the azuracast user.

• HIGH 8.8CVE-2026-100856public exploit available2026-09-27

  AzuraCast before 0.23.6 is vulnerable to code injection due to incomplete migration, allowing attackers to inject Liquidsoap syntax and execute arbitrary code, disclose API keys, or disrupt station operations.

• MEDIUM 6.5CVE-2026-100855public exploit available2026-09-27
• MEDIUM 6.3CVE-2026-100854public exploit available2026-09-27
• MEDIUM 5.9CVE-2026-100853public exploit available2026-09-27
• HIGH 8.8CVE-2026-100852public exploit available2026-09-27

  This vulnerability allows authenticated users with Streamers and Profile permissions to inject shell commands, leading to potential command execution as the Liquidsoap process user.

• HIGH 7.6CVE-2026-100851public exploit available2026-09-27

  AzuraCast allows users with only View Station Page permission to access plaintext Icecast/Shoutcast admin passwords through a vulnerable API endpoint, enabling unauthorized access to streaming server administration interfaces.

• HIGH 7.7CVE-2026-100850public exploit available2026-09-27

  The flaw allows a user with Media permission to read local files or internal HTTP endpoints, and the contents are exposed to users with Broadcasting permission, posing a significant security risk.

• HIGH 7.1CVE-2026-100849public exploit available2026-09-27
• HIGH 7.1CVE-2026-100848public exploit available2026-09-27
• HIGH 7.5CVE-2026-100847public exploit available2026-09-27

  AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter that allows attackers to inject arbitrary DQL expressions and extract sensitive database information including user credentials and station settings.

• HIGH 7.6CVE-2026-100846public exploit available2026-09-27

  The MONAI library has a dangerous deserialization flaw that allows attackers to execute arbitrary code when processing untrusted pickle files. This vulnerability exists in the algo_from_pickle function and can be triggered when applications load attacker-controlled .pkl files.

• HIGH 7.8CVE-2026-100845public exploit available2026-09-27

  The flaw is an unsafe deserialization vulnerability in the NumpyReader class of MONAI, allowing attackers to execute arbitrary code via malicious .npy files. This matters because it can lead to remote code execution, which is highly impactful.

• HIGH 8.4CVE-2026-100844public exploit available2026-09-27

  The flaw allows for OS command injection due to improper handling of user-controlled inputs, enabling arbitrary command execution.

• HIGH 7.8CVE-2026-100843public exploit available2026-09-27

  The flaw allows remote code execution due to unsafe deserialization of pickle files, enabling attackers to execute arbitrary commands.

• HIGH 7CVE-2026-100842public exploit available2026-09-27
• HIGH 7.8CVE-2026-100841public exploit available2026-09-27

  The flaw allows a local user with write access to a shared cache directory to place a malicious pickle file, leading to arbitrary code execution in the context of another user's MONAI pipeline.

• HIGH 7.8CVE-2026-100840public exploit available2026-09-27

  The flaw allows remote code execution by resolving arbitrary importable callables and passing $ expressions to Python eval(), enabling attackers to execute arbitrary code when a victim loads a malicious bundle.

• HIGH 8.4CVE-2026-100839public exploit available2026-09-27

  This flaw allows an attacker with control over the host to inject malicious AML bytecode into the guest kernel, leading to arbitrary code execution and potential data disclosure or modification.

• HIGH 8.1CVE-2026-100838public exploit available2026-09-27

  The flaw in Contrast's pre-1.19.1 agent policies allows arbitrary writes to the guest root filesystem, enabling a full guest takeover by a malicious host process.

• LOW 3.7CVE-2026-100837public exploit available2026-09-27
• MEDIUM 4.3CVE-2026-100836public exploit available2026-09-27
• HIGH 7.4CVE-2026-100835public exploit available2026-09-27
• MEDIUM 5.9CVE-2026-100834public exploit available2026-09-27
• HIGH 8.2CVE-2026-100833public exploit available2026-09-27

  This flaw allows an attacker with access to the Kata agent API to substitute a container image with an exploit payload, undermining the integrity guarantees of the container.