All CVEs — page 541 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• CRITICAL 9.8CVE-2026-93012public exploit available2026-09-21

  This vulnerability allows arbitrary command execution on Windows when the envelope address is controlled by an attacker, leading to potential remote code execution as the sending process.

• MEDIUM 4.1CVE-2026-923822026-09-21

  The flaw allows an out-of-bounds write by exploiting a usbredir isochronous OUT stream, potentially leading to arbitrary code execution or data corruption.

• MEDIUM 6.3CVE-2026-69190public exploit available2026-09-21

  Users with edit permissions but without entity ownership can exploit a flaw in Graylog to gain full control over saved searches and dashboards, allowing them to delete or modify content.

• HIGH 8.1CVE-2026-62369public exploit available2026-09-21

  The flaw allows an attacker to write or overwrite files with elevated privileges by exploiting improperly validated archive entries, potentially leading to persistent system modification or code execution.

• HIGH 8.8CVE-2026-62182public exploit available2026-09-21

  The flaw allows an authenticated user to include shell metacharacters in the ConfigUpdateJob, leading to arbitrary command execution with the privileges of the KubeEdge process.

• MEDIUM 4.3CVE-2026-61745public exploit available2026-09-21

  The flaw allows any authenticated user to restart any machine, even without ADMIN role, by exploiting a misconfigured API endpoint in InvenTree versions prior to 1.4.0.

• MEDIUM 5.7CVE-2026-61612public exploit available2026-09-21

  The flaw allows SSRF attacks by not fully validating server URLs, enabling requests to internal addresses like loopback and cloud metadata.

• UNSCOREDCVE-2026-55473public exploit available2026-09-21
• HIGH 8.1CVE-2026-48976public exploit available2026-09-21

  The flaw allows an authenticated user to read and potentially modify notifiers belonging to other tenants, exposing sensitive credentials and redirecting notifications to attacker-controlled webhooks.

• HIGH 8.1CVE-2026-48975public exploit available2026-09-21

  The flaw allows a low-privileged user to overwrite or delete another tenant's maintenance entry, posing a significant risk to data integrity.

• MEDIUM 5.4CVE-2026-48974public exploit available2026-09-21

  The flaw allows any authenticated user to add another account to their group without proper authorization, leading to potential unauthorized access and data exposure.

• HIGH 8.1CVE-2026-48826public exploit available2026-09-21

  The flaw allows a user to delete another group's inventory by exploiting the global owner role, leading to data loss.

• HIGH 7.5CVE-2026-944492026-09-21

  The flaw in SmallRye Fault Tolerance library causes a memory leak when using ApplyGuard or ApplyFaultTolerance annotations, leading to potential application crashes due to increased memory usage.

• HIGH 8.8CVE-2026-84990public exploit available2026-09-21

  The flaw allows any authenticated non-admin user to list and download system-configuration backups, potentially disclosing sensitive information such as password hashes and API tokens.

• HIGH 8.1CVE-2026-83621public exploit available2026-09-21

  The flaw allows non-admin users to modify system settings, including threat-intelligence blocklists, potentially leading to unauthorized content access and disruption of monitoring.

• CRITICAL 9.9CVE-2026-79920public exploit available2026-09-21

  The flaw allows any authenticated user to execute arbitrary code as root by manipulating plugin installation and uninstallation tasks, leading to full host compromise.

• UNSCOREDCVE-2026-77582public exploit available2026-09-21
• MEDIUM 5.3CVE-2026-77561public exploit available2026-09-21

  The flaw allows unauthenticated attackers to trigger a global login lockdown by sending POST requests with nonexistent usernames, leading to HTTP 429 rate limiting for legitimate users.

• HIGH 8.1CVE-2026-77560public exploit available2026-09-21

  The flaw in Tinyauth allows an authenticated low-privilege user to bypass per-app access controls by using a differently cased hostname, leading to unauthorized access to restricted applications.

• UNSCOREDCVE-2026-76898public exploit available2026-09-21
• LOW 3.7CVE-2026-63416public exploit available2026-09-21

  The flaw allows unauthenticated requests to inject traversal segments and access unintended internal routes, potentially exposing sensitive endpoints.

• MEDIUM 4.2CVE-2026-63373public exploit available2026-09-21

  The flaw allows an attacker to hijack a victim's draw.io session by exploiting OAuth callback handling in self-hosted deployments, leading to potential misattribution of cloud-storage actions.

• MEDIUM 6.8CVE-2026-63334public exploit available2026-09-21

  The flaw allows an attacker to forge server-side requests by manipulating DNS resolutions, potentially exposing internal network resources through a proxy.

• HIGH 8.8CVE-2026-63116public exploit available2026-09-21

  The flaw allows any authenticated user to modify arbitrary protected records, corrupt application state, or cause service disruption due to missing permission checks.

• MEDIUM 5.8CVE-2026-62987public exploit available2026-09-21

  The flaw allows unauthenticated clients to manipulate or remove critical headers like ClientIPHeader, TLSHeader, and RequestID before they reach the backend service, potentially undermining security measures.