All CVEs — page 542 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• MEDIUM 6.2CVE-2026-62866public exploit available2026-09-21

  The flaw in Dasel allows an attacker to cause a panic due to index-out-of-range errors by providing input ending in whitespace. This matters because it can lead to service disruption.

• HIGH 8.8CVE-2026-62371public exploit available2026-09-21

  The flaw allows an attacker with permission to create or update NodeUpgradeJob resources to inject shell metacharacters, leading to arbitrary command execution with the privileges of the upgrade process.

• MEDIUM 6.5CVE-2026-62370public exploit available2026-09-21

  The flaw allows an authenticated edge peer to cause memory exhaustion and disrupt cloud-edge communication by sending crafted headers with excessive declared lengths.

• UNSCOREDCVE-2026-61674public exploit available2026-09-21
• MEDIUM 6.2CVE-2026-59168public exploit available2026-09-21

  The flaw allows deep nesting of JSON or XML data to exhaust the Go goroutine stack, leading to a fatal error. This matters because it can cause service disruption without proper mitigation.

• MEDIUM 6.1CVE-2026-58504public exploit available2026-09-21

  A vulnerability allows execution of attacker-controlled JavaScript when processing crafted .drawio files, potentially exposing sensitive data and cookies.

• MEDIUM 6CVE-2026-17051public exploit available2026-09-21

  This flaw allows an attacker to cause an out-of-bounds write by setting a length field in the doorbell register beyond the buffer size, leading to potential static memory corruption.

• MEDIUM 5.7CVE-2026-17050public exploit available2026-09-21

  This flaw allows a malicious USB device to cause a double-free vulnerability by manipulating descriptor responses during device enumeration, potentially leading to system instability or crashes.

• MEDIUM 4.3CVE-2026-88978public exploit available2026-09-21

  The flaw allows an authenticated tenant worker to retrieve durable event-log records from another tenant by exploiting a lack of tenant filter in the WorkerStatus gRPC polling path.

• CRITICAL 9.8CVE-2026-85751public exploit available2026-09-21

  The flaw allows an unauthenticated attacker to bypass authentication by spoofing the X-Forwarded-By header, which is critical for securing mail server deployments.

• LOW 3.1CVE-2026-84298public exploit available2026-09-21

  The flaw allows an authenticated tenant worker to intercept another tenant's task callback if they know the task UUID and keep a stream open on the same dispatcher process.

• HIGH 8.8CVE-2026-82412public exploit available2026-09-21

  The vulnerability allows any authenticated non-admin user to execute operating-system commands as the ntopng process account, posing a significant risk due to the lack of proper input validation.

• LOW 2.4CVE-2026-771662026-09-21
• MEDIUM 6.5CVE-2026-771652026-09-21

  Users could not unlock locks placed by other users, potentially leading to data loss or unavailability.

• MEDIUM 6.3CVE-2026-63342public exploit available2026-09-21

  The flaw allows an authenticated user to read another tenant's durable task event logs by exploiting a misconfigured API endpoint, potentially revealing sensitive workflow details.

• HIGH 7.1CVE-2026-61687public exploit available2026-09-21

  The flaw allows unauthenticated attackers to bind a victim's session to an attacker-controlled OAuth identity by exploiting an empty state parameter acceptance in ValidateOAuthState before version 0.91.1.

• MEDIUM 4.1CVE-2026-61681public exploit available2026-09-21

  The flaw allows an authenticated user to replace the UnsubscribeURL with an internal URL, leading to potential exposure of sensitive data and credentials.

• UNSCOREDCVE-2026-55563public exploit available2026-09-21
• HIGH 8.8CVE-2026-53940public exploit available2026-09-21

  The flaw allows a malicious package to write an executable wrapper outside the intended directory or overwrite another entry point, leading to potential code execution with the installing user's privileges.

• MEDIUM 5.2CVE-2026-36472public exploit available2026-09-21

  The flaw allows a remote attacker to inject arbitrary JavaScript into an authenticated user's session via unsanitized clickable links on the msg_info page, leading to potential data theft or manipulation.

• MEDIUM 5.8CVE-2026-36471public exploit available2026-09-21
• MEDIUM 5.8CVE-2026-36470public exploit available2026-09-21
• CRITICAL 9.1CVE-2026-36469public exploit available2026-09-21

  CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) allowing attackers to forge requests and potentially access internal services or networks.

• MEDIUM 6.1CVE-2026-36468public exploit available2026-09-21

  The flaw is a cross-site scripting (XSS) vulnerability in CuteNews v.2.1.2 that allows remote unauthenticated attackers to inject malicious scripts via URL parameters, potentially leading to information disclosure or user manipulation.

• HIGH 7.2CVE-2026-36467public exploit available2026-09-21

  This vulnerability allows remote authenticated users to execute arbitrary code by uploading a file with a dangerous type, leading to potential remote server access.