All CVEs — page 544 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• UNSCOREDCVE-2026-94401public exploit available2026-09-21
• UNSCOREDCVE-2026-94394public exploit available2026-09-21
• UNSCOREDCVE-2026-94393public exploit available2026-09-21
• MEDIUM 5.4CVE-2026-94387public exploit available2026-09-21

  A stored cross-site scripting vulnerability in Aureus ERP before 1.6.0 allows users to inject malicious markup via Chatter field-change logs, potentially leading to client-side code execution when viewed by other users.

• MEDIUM 4.2CVE-2026-94382public exploit available2026-09-21

  The vulnerability allows any authenticated user to create or delete alerts on systems they shouldn't have access to, potentially disclosing sensitive information.

• UNSCOREDCVE-2026-938842026-09-21
• UNSCOREDCVE-2026-888072026-09-21
• HIGH 7.5CVE-2026-888062026-09-21
• LOW 3.7CVE-2026-852202026-09-21

  The vulnerability allows unauthenticated attackers to perform a Denial-of-Service attack on the Thinkst Canary honeypot Redis service by exploiting its enabled state.

• HIGH 7.2CVE-2025-71421public exploit available2026-09-21

  The flaw allows agents with agent-management privilege to escalate their role to administrator, gaining full administrative control.

• MEDIUM 4.3CVE-2025-71420public exploit available2026-09-21

  The flaw allows authenticated agents to access restricted saved replies, potentially exposing sensitive information across support groups.

• MEDIUM 5.4CVE-2025-71419public exploit available2026-09-21

  The flaw allows attackers with ROLE_AGENT to inject malicious scripts via the SwiftMailer configuration identifier parameter, leading to cross-site scripting (XSS) attacks.

• UNSCOREDCVE-2026-94383public exploit available2026-09-21
• UNSCOREDCVE-2026-94381public exploit available2026-09-21
• UNSCOREDCVE-2026-94379public exploit available2026-09-21
• UNSCOREDCVE-2026-94374public exploit available2026-09-21
• UNSCOREDCVE-2026-94373public exploit available2026-09-21
• UNSCOREDCVE-2026-94372public exploit available2026-09-21
• MEDIUM 4.3CVE-2026-94216public exploit available2026-09-21

  The vulnerability allows for open redirect through manipulation of the Success argument in the authorize function of ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717, posing a security risk.

• MEDIUM 4.3CVE-2026-94214public exploit available2026-09-21

  The vulnerability allows for open redirect via manipulation of the Host argument in /login.html, enabling remote attackers to potentially redirect users to malicious sites.

• LOW 2.4CVE-2026-94211public exploit available2026-09-21
• HIGH 8.8CVE-2026-842852026-09-21

  This vulnerability allows an attacker to execute arbitrary commands on the server by injecting OS commands, posing a significant risk to server security.

• HIGH 7.1CVE-2026-943682026-09-21

  The flaw in noobaa-core's signature verification logic allows attackers to add unsigned headers, enabling unauthorized CopyObject operations and data copying.

• LOW 3.5CVE-2026-94210public exploit available2026-09-21

  The flaw allows cross-site scripting (XSS) via the getAllGrouped function in Hyve5 Leantime up to version 3.9.8, enabling remote attackers to inject malicious scripts.

• MEDIUM 4.3CVE-2026-918672026-09-21

  The flaw in Neethi allows a server to perform a denial of service by trickling bytes slowly during policy reference fetches, tying up the calling thread indefinitely.