All CVEs — page 536 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• MEDIUM 4.3CVE-2026-94536public exploit available2026-09-21

  The flaw allows authenticated users to read any employee's roles and permissions by exploiting the unvalidated employeeId parameter, posing a security risk.

• HIGH 7.1CVE-2026-94535public exploit available2026-09-21

  The vulnerability allows authenticated users to delete other users' notifications without proper validation, enabling unauthorized data modification.

• HIGH 7.1CVE-2026-94534public exploit available2026-09-21

  The flaw allows authenticated attackers to modify any user's profile fields, including nicknames and avatars, by exploiting PUT requests to specific endpoints.

• MEDIUM 6.5CVE-2026-94533public exploit available2026-09-21

  This vulnerability allows authenticated users to download any file stored by other users due to a lack of proper file ownership validation, enabling unauthorized access to sensitive information.

• MEDIUM 6.5CVE-2026-94532public exploit available2026-09-21

  The flaw allows authenticated users to read other users' full profiles, including sensitive information like mobile numbers and national identity card numbers.

• MEDIUM 6.8CVE-2026-93340public exploit available2026-09-21

  The flaw allows unauthenticated attackers to exploit a password reset link poisoning vulnerability by manipulating the client-supplied origin parameter, leading to potential full account takeover.

• MEDIUM 5.3CVE-2026-88756public exploit available2026-09-21
• HIGH 8.8CVE-2026-887382026-09-21

  The Jazzware RT1000 Edge webUI v. 20.0.1 allows an attacker with administrative privileges to upload a server-side executable file, leading to remote code execution.

• HIGH 7.8CVE-2026-79079public exploit available2026-09-21

  A local attacker can execute arbitrary code in CrossWire Xiphos <= 4.3.2 by exploiting vulnerabilities in the src/main/url.cc and src/gtk/menu_popup.c components, allowing for full control over the application.

• CRITICAL 9.8CVE-2026-78847public exploit available2026-09-21

  The flaw allows arbitrary code execution via the JavaScript engine parsing front matter when the language is set to js/javascript, posing a critical security risk.

• MEDIUM 5.5CVE-2026-78806public exploit available2026-09-21
• UNSCOREDCVE-2026-65980public exploit available2026-09-21
• UNSCOREDCVE-2026-61852public exploit available2026-09-21
• UNSCOREDCVE-2026-61851public exploit available2026-09-21
• MEDIUM 6.3CVE-2026-61743public exploit available2026-09-21
• UNSCOREDCVE-2026-61652public exploit available2026-09-21
• UNSCOREDCVE-2026-61541public exploit available2026-09-21
• MEDIUM 5.4CVE-2026-59830public exploit available2026-09-21

  The flaw allows user-controlled display names to contain HTML, enabling script injection in post actions. This can lead to cross-site scripting (XSS) attacks.

• MEDIUM 4.3CVE-2026-59815public exploit available2026-09-21

  The flaw allows a low-privileged authenticated user to create items under a share ID before acceptance, potentially injecting content into shared folders without proper authorization.

• HIGH 7.6CVE-2026-59814public exploit available2026-09-21

  Joplin Server allows low-privileged users to upload attachments with empty titles that execute arbitrary scripts when victims open public shares. This enables attackers to perform actions on behalf of authenticated victims using same-origin script execution.

• HIGH 7.4CVE-2026-55210public exploit available2026-09-21

  The flaw allows an attacker to gain access to a local user's Joplin account by exploiting SAML authentication, potentially leading to unauthorized access or modifications of notes and settings.

• MEDIUM 4.4CVE-2026-46650public exploit available2026-09-21

  The flaw allows a low-privileged user to inject malicious JavaScript via crafted HTML notes, potentially leading to script execution in the Joplin Server origin.

• MEDIUM 5.3CVE-2026-17054public exploit available2026-09-21

  This vulnerability allows an attacker to cause a denial of service by manipulating frame lengths in control responses, leading to buffer overflows and incorrect data processing.

• MEDIUM 5.3CVE-2026-15890public exploit available2026-09-21

  The flaw involves a race condition in the nonce generation for secure storage operations, leading to nonce reuse with the same key, which can result in plaintext leakage and authentication key exposure.

• MEDIUM 4.4CVE-2026-945882026-09-21

  The flaw allows for argument injection in package changelog retrieval through improperly handled user input, posing a medium security risk.