All CVEs — page 8 of 42

The complete archive, 25 per page, newest first. 1030 records. Search instead.

• MEDIUM 4.3CVE-2026-61748public exploit available2026-09-21

  The flaw allows unauthorized access to report and label printing functionalities by bypassing permission checks, exposing sensitive data.

• MEDIUM 4.3CVE-2026-61747public exploit available2026-09-21

  The flaw allows any authenticated user to access another user's import session data, exposing sensitive information. This matters because it breaches data privacy despite users being considered trusted within the InvenTree system.

• MEDIUM 5.3CVE-2026-61746public exploit available2026-09-21

  The flaw allows unauthenticated access to plugin settings metadata and non-secret configuration values, posing a risk of sensitive information disclosure.

• MEDIUM 6.5CVE-2026-61744public exploit available2026-09-21

  The flaw allows low-privilege users to enumerate primary keys and disclose sensitive inventory data by exploiting the lack of proper role checks in the InvenTree barcode API endpoint.

• CRITICAL 9.3CVE-2026-58491public exploit available2026-09-21

  The flaw allows attackers to inject markup and JavaScript via a crafted SSO link, potentially leading to session data access or actions through user APIs; it also enables open redirects.

• HIGH 7.8CVE-2026-498102026-09-21

  The flaw allows a low-privileged attacker with local access to insert sensitive information into log files, potentially leading to information disclosure.

• HIGH 7.8CVE-2026-17052public exploit available2026-09-21

  The flaw allows an unprivileged user to write arbitrary values to kernel memory through a syscall, potentially leading to privilege escalation or system crashes.

• HIGH 8.2CVE-2026-94488public exploit available2026-09-21

  The flaw allows for XSS in Telegram Desktop before version 6.9.4 due to improper handling of HTML export, posing a high risk if exploited.

• UNSCOREDCVE-2026-93012public exploit available2026-09-21
• MEDIUM 4.1CVE-2026-923822026-09-21

  The flaw allows an out-of-bounds write by exploiting a usbredir isochronous OUT stream, potentially leading to arbitrary code execution or data corruption.

• MEDIUM 6.3CVE-2026-69190public exploit available2026-09-21

  Users with edit permissions but without entity ownership can exploit a flaw in Graylog to gain full control over saved searches and dashboards, allowing them to delete or modify content.

• HIGH 8.1CVE-2026-62369public exploit available2026-09-21

  The DecompressTarGz function in KubeEdge improperly validates archive entry names, allowing for potential file overwrites or modifications with elevated privileges.

• HIGH 8.8CVE-2026-62182public exploit available2026-09-21

  The flaw allows authenticated users to inject shell metacharacters into command execution, leading to arbitrary code execution with KubeEdge process privileges.

• MEDIUM 4.3CVE-2026-61745public exploit available2026-09-21

  The flaw allows any authenticated user to restart any machine, even without ADMIN role, by exploiting a misconfigured API endpoint in InvenTree versions prior to 1.4.0.

• MEDIUM 5.7CVE-2026-61612public exploit available2026-09-21

  The flaw allows SSRF attacks by not fully validating server URLs, enabling requests to internal addresses like loopback and cloud metadata.

• UNSCOREDCVE-2026-55473public exploit available2026-09-21
• HIGH 8.1CVE-2026-48976public exploit available2026-09-21

  The flaw allows an authenticated user to read and potentially modify notifiers belonging to other tenants, exposing sensitive credentials and redirecting notifications to attacker-controlled webhooks.

• HIGH 8.1CVE-2026-48975public exploit available2026-09-21

  The flaw allows an authenticated low-privileged user to overwrite or delete another tenant's maintenance entry by not verifying group ownership, posing a significant security risk.

• MEDIUM 5.4CVE-2026-48974public exploit available2026-09-21

  The flaw allows any authenticated user to add another account to their group without proper authorization, leading to potential unauthorized access and data exposure.

• HIGH 8.1CVE-2026-48826public exploit available2026-09-21

  The flaw allows a user to delete another group's inventory by exploiting the global owner privilege through the X-Tenant header, leading to irreversible data loss.

• HIGH 7.5CVE-2026-944492026-09-21

  The flaw in SmallRye Fault Tolerance library causes a memory leak when using ApplyGuard or ApplyFaultTolerance annotations, leading to potential application crashes due to increased memory usage.

• HIGH 8.8CVE-2026-84990public exploit available2026-09-21

  The flaw allows any authenticated non-admin user to list and download system configuration backups, disclosing sensitive data like password hashes and API tokens.

• HIGH 8.1CVE-2026-83621public exploit available2026-09-21

  The flaw allows non-admin users to modify system settings and redirect threat-intelligence downloads, compromising integrity and availability.

• CRITICAL 9.9CVE-2026-79920public exploit available2026-09-21

  The flaw allows any authenticated user to execute arbitrary code as root by manipulating plugin installation tasks, leading to full host compromise.

• UNSCOREDCVE-2026-77582public exploit available2026-09-21