All CVEs — page 520 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• UNSCOREDCVE-2026-77987public exploit available2026-09-22
• UNSCOREDCVE-2026-77912public exploit available2026-09-22
• UNSCOREDCVE-2026-77426public exploit available2026-09-22
• MEDIUM 4.3CVE-2026-77425public exploit available2026-09-22
• UNSCOREDCVE-2026-76910public exploit available2026-09-22
• UNSCOREDCVE-2026-76909public exploit available2026-09-22
• UNSCOREDCVE-2026-75101public exploit available2026-09-22
• HIGH 8.8CVE-2026-67615public exploit available2026-09-22

  This vulnerability allows authenticated non-guest users to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint, leading to remote code execution.

• LOW 2.3CVE-2026-62364public exploit available2026-09-22
• HIGH 7.8CVE-2026-945742026-09-22

  A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a writable configuration file path, allowing unprivileged users to execute arbitrary code and potentially escalate local privileges.

• CRITICAL 9.1CVE-2026-892822026-09-22

  The flaw allows authenticated users to write to the default install directory, posing a risk of unauthorized code execution or data modification.

• HIGH 8.4CVE-2026-892812026-09-22

  This vulnerability allows local code execution due to a hardcoded path in the openssl.cnf configuration file within the Apache Lounge Windows distribution of Apache HTTP Server.

• CRITICAL 9.1CVE-2026-88624public exploit available2026-09-22

  This vulnerability allows attackers to execute arbitrary recursive directory deletion by exploiting missing path validation in the Worktree.remove component of openCode v1.18.26, posing a critical risk to system integrity.

• HIGH 8.8CVE-2026-88419public exploit available2026-09-22

  The flaw allows an authenticated low-privileged user to upload a .php file, leading to arbitrary code execution on the server due to lack of proper file extension validation and content checks.

• HIGH 8.8CVE-2026-88418public exploit available2026-09-22

  CMSimple 5.24 lacks CSRF protection, allowing unauthenticated attackers to inject and execute arbitrary PHP code via specially crafted content-save requests.

• UNSCOREDCVE-2026-88416public exploit available2026-09-22
• UNSCOREDCVE-2026-88350public exploit available2026-09-22
• HIGH 7.5CVE-2026-88345public exploit available2026-09-22
• HIGH 7.5CVE-2026-88344public exploit available2026-09-22
• MEDIUM 5.5CVE-2026-88341public exploit available2026-09-22
• HIGH 7.6CVE-2026-88340public exploit available2026-09-22

  YARA 4.5.8 contains a memory corruption vulnerability in its compiled rule file deserialization process, where invalid pointer releases can occur during rule destruction or object creation, potentially leading to application crashes or memory corruption when processing specially crafted .yrc files.

• MEDIUM 5.5CVE-2026-88339public exploit available2026-09-22
• CRITICAL 9.8CVE-2026-87121public exploit available2026-09-22

  The lwIP TCP/IP Stack MQTT implementation is vulnerable to an out-of-bounds write, enabling full code execution on the device. This flaw is critical as it allows attackers to gain control over the device.

• MEDIUM 6.4CVE-2026-83805public exploit available2026-09-22
• MEDIUM 5.4CVE-2026-83801public exploit available2026-09-22