All CVEs — page 439 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• HIGH 7.6CVE-2026-100705public exploit available2026-09-26

  Kyverno allows attackers to perform server-side request forgery by bypassing egress filters on legacy API call executors, enabling access to internal services and cloud metadata endpoints using Kyverno's network position and ServiceAccount token.

• HIGH 7.7CVE-2026-100704public exploit available2026-09-26

  This flaw in Kyverno allows unsigned or untrusted images to bypass image signature verification in Kubernetes clusters, posing a significant security risk.

• HIGH 7.7CVE-2026-100703public exploit available2026-09-26

  The flaw allows a tenant to access cluster-scoped data from other namespaces without proper RBAC permissions, due to the global context library not being confined to the policy's namespace.

• MEDIUM 5.9CVE-2026-100702public exploit available2026-09-26
• MEDIUM 5.9CVE-2026-100701public exploit available2026-09-26
• HIGH 7.5CVE-2026-100700public exploit available2026-09-26

  The vulnerability is a denial-of-service flaw in nodemailer's addressparser where crafted email headers can trigger quadratic backtracking in regex patterns, causing the Node.js event loop to block for tens of seconds and leading to service unavailability.

• MEDIUM 5.3CVE-2026-100699public exploit available2026-09-26
• MEDIUM 5.8CVE-2026-100698public exploit available2026-09-26
• HIGH 8.6CVE-2026-100697public exploit available2026-09-26

  Adminer is vulnerable to pre-authentication server-side request forgery when the official ClickHouse driver plugin is loaded, allowing unauthenticated attackers to execute SQL queries and potentially disclose sensitive information.

• MEDIUM 5.8CVE-2026-100696public exploit available2026-09-26
• MEDIUM 6.1CVE-2026-100695public exploit available2026-09-26
• MEDIUM 6.1CVE-2026-100694public exploit available2026-09-26
• HIGH 8.4CVE-2026-100693public exploit available2026-09-26

  The flaw in Hugo versions from v0.162.0 to v0.165.0 allows attackers to bypass IP-literal deny rules by using mixed-case URL schemes, potentially enabling unauthorized access to restricted resources.

• HIGH 7.5CVE-2026-100692public exploit available2026-09-26

  Hugo's symlink confinement checks were bypassed in versions after v0.123.0 and before v0.166.0, allowing themes or modules to contain symlinks that could expose files outside the intended mount root during site builds. This vulnerability enables unauthorized file reads through resource functions like resources.Get.

• MEDIUM 5.4CVE-2026-100691public exploit available2026-09-26
• HIGH 7.5CVE-2026-100690public exploit available2026-09-26

  Hugo's Node.js permission model fails to detect symbolic links that escape the project sandbox, allowing attackers to read arbitrary files like /etc/passwd through PostCSS plugins. This affects builds using default security settings and can lead to sensitive data disclosure.

• MEDIUM 5.9CVE-2026-100689public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100688public exploit available2026-09-26
• MEDIUM 5.5CVE-2026-100687public exploit available2026-09-26
• HIGH 8.1CVE-2026-100686public exploit available2026-09-26

  This flaw allows builders to assign application roles across workspace boundaries, potentially granting admin roles in other workspaces.

• HIGH 7.7CVE-2026-100685public exploit available2026-09-26

  The flaw allows builders with access to a single workspace to enumerate chat identity link records across all workspaces in a tenant, exposing sensitive data such as user IDs and external chat service identifiers.

• HIGH 8.1CVE-2026-100684public exploit available2026-09-26

  This vulnerability allows an attacker to bypass authentication by asserting a victim's invited email address, gaining full access to the application or tenant.

• HIGH 8CVE-2026-100683public exploit available2026-09-26

  The flaw allows an attacker with DDL rights to inject SQL commands, leading to potential data manipulation or deletion.

• HIGH 8.8CVE-2026-100682public exploit available2026-09-26

  This vulnerability allows attackers with BUILDER role to write arbitrary files as root via a malicious ZIP archive, enabling remote code execution.

• MEDIUM 5.4CVE-2026-100681public exploit available2026-09-26