All CVEs — page 539 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• MEDIUM 5.3CVE-2026-79319public exploit available2026-09-21
• MEDIUM 6.5CVE-2026-79318public exploit available2026-09-21
• HIGH 7.5CVE-2026-73552public exploit available2026-09-21

  The flaw allows a downstream client to bypass RBAC policies by manipulating opaque headers, potentially allowing unauthorized access to routes intended for denial.

• HIGH 7.5CVE-2026-73550public exploit available2026-09-21

  The flaw allows unauthenticated clients to exploit HPACK indexing to submit large Host values, causing out-of-memory issues in Envoy proxies.

• MEDIUM 5.3CVE-2026-73549public exploit available2026-09-21

  The flaw allows reconstruction of scoped IPv6 addresses leading to process termination in specific configurations; it matters because it can disrupt service availability.

• HIGH 7.5CVE-2026-73548public exploit available2026-09-21

  The flaw allows an unauthenticated HTTP/2 client to smuggle a complete HTTP/1.1 request and response through Envoy, potentially intercepting sensitive data. This matters because it can lead to unauthorized access and data exposure.

• HIGH 7.5CVE-2026-73547public exploit available2026-09-21

  The flaw allows an unauthenticated client to crash Envoy by sending a path-less CONNECT request, exploiting misconfiguration of query-parameter mutation in the ext_authz filter.

• HIGH 7.4CVE-2026-73546public exploit available2026-09-21

  The flaw allows attacker-controlled path segments to be incorporated into cached dynamic statistic names, enabling script execution with admin interface privileges.

• HIGH 7.5CVE-2026-73513public exploit available2026-09-21

  The flaw allows a malformed HTTP/2 response trailer to crash Envoy, potentially leading to service disruption.

• HIGH 7.5CVE-2026-73512public exploit available2026-09-21

  The flaw allows HTTP/3 datagrams to call decodeData through a freed decoder, causing process crashes. It matters because it can lead to service disruptions and security vulnerabilities.

• MEDIUM 6.5CVE-2026-62247public exploit available2026-09-21

  The flaw allows a client with presence.write permission but denied presence.read to receive presence metadata from other clients, potentially exposing sensitive information like location and online status.

• MEDIUM 6.8CVE-2026-58271public exploit available2026-09-21

  The flaw allows an attacker to bypass multi-factor authentication (MFA) and gain full access by successfully guessing a TOTP code or directly disabling MFA.

• HIGH 8.1CVE-2026-58269public exploit available2026-09-21

  The flaw allows an attacker to bypass two-factor authentication (2FA) by exploiting the `POST /api/auth/token` endpoint, which returns full access tokens without checking 2FA status.

• HIGH 8.8CVE-2026-55897public exploit available2026-09-21

  The flaw allows an authenticated user with specific permissions to execute arbitrary commands as root via the luci-app-advanced-reboot web interface, posing a significant security risk.

• HIGH 8.8CVE-2026-55159public exploit available2026-09-21

  The flaw allows an authenticated delegated user to inject malicious cron entries, leading to persistent command execution as root.

• MEDIUM 5.4CVE-2026-54915public exploit available2026-09-21

  The flaw allows unauthenticated users to manipulate the redirect_uri parameter, leading to potential phishing attacks or unauthorized redirects outside Tautulli.

• UNSCOREDCVE-2026-52835public exploit available2026-09-21
• MEDIUM 5.9CVE-2026-50572public exploit available2026-09-21

  The flaw allows a use-after-free condition in Envoy's HTTP external-authorization client, leading to potential process crashes under production traffic.

• UNSCOREDCVE-2026-49995public exploit available2026-09-21
• HIGH 8.4CVE-2026-498112026-09-21

  This vulnerability in Dell Command | Monitor (DCM) versions prior to 10.13.2 allows a low-privileged local attacker to gain elevated privileges, leading to potential system compromise.

• MEDIUM 5.9CVE-2026-48521public exploit available2026-09-21

  The flaw allows dereferencing of a null pointer in Envoy's connection pool allocation logic, potentially leading to worker crashes under specific conditions.

• UNSCOREDCVE-2026-45381public exploit available2026-09-21
• HIGH 8.8CVE-2026-94501public exploit available2026-09-21

  This vulnerability allows authenticated users to bypass authorization checks and manipulate user-role mappings, leading to potential privilege escalation and access control modifications.

• HIGH 8.3CVE-2026-94497public exploit available2026-09-21

  The flaw allows authenticated users to bypass authorization checks and modify or delete other users' business objects, posing a significant security risk.

• HIGH 8.3CVE-2026-94496public exploit available2026-09-21

  The flaw allows authenticated users to modify role permissions, potentially leading to privilege escalation and unauthorized access to all business records.