All CVEs — page 9 of 42

The complete archive, 25 per page, newest first. 1030 records. Search instead.

• MEDIUM 5.3CVE-2026-77561public exploit available2026-09-21

  The flaw allows unauthenticated attackers to trigger a global login lockdown by sending POST requests with nonexistent usernames, leading to HTTP 429 rate limiting for legitimate users.

• HIGH 8.1CVE-2026-77560public exploit available2026-09-21

  The flaw allows an authenticated low-privilege user to bypass per-app access controls by using a differently cased hostname, potentially gaining unauthorized access. This matters because it undermines security measures designed to restrict access based on case-insensitive hostnames.

• UNSCOREDCVE-2026-76898public exploit available2026-09-21
• LOW 3.7CVE-2026-63416public exploit available2026-09-21

  The flaw allows unauthenticated requests to inject traversal segments and access unintended internal routes, potentially exposing sensitive endpoints.

• MEDIUM 4.2CVE-2026-63373public exploit available2026-09-21

  The flaw allows an attacker to hijack a victim's draw.io session by exploiting OAuth callback handling in self-hosted deployments, leading to potential misattribution of cloud-storage actions.

• MEDIUM 6.8CVE-2026-63334public exploit available2026-09-21

  The flaw allows an attacker to forge server-side requests by manipulating DNS resolutions, potentially exposing internal network resources through a proxy.

• HIGH 8.8CVE-2026-63116public exploit available2026-09-21

  The flaw allows any authenticated user to modify protected records without proper authorization checks, leading to potential data corruption or service disruption.

• MEDIUM 5.8CVE-2026-62987public exploit available2026-09-21

  The flaw allows unauthenticated clients to manipulate or remove critical headers like ClientIPHeader, TLSHeader, and RequestID before they reach the backend service, potentially undermining security measures.

• MEDIUM 6.2CVE-2026-62866public exploit available2026-09-21

  The flaw in Dasel allows an attacker to cause a panic due to index-out-of-range errors by providing input ending in whitespace. This matters because it can lead to service disruption.

• HIGH 8.8CVE-2026-62371public exploit available2026-09-21

  The flaw allows authenticated users to inject shell metacharacters into command parameters, leading to arbitrary command execution with upgrade process privileges.

• MEDIUM 6.5CVE-2026-62370public exploit available2026-09-21

  The flaw allows an authenticated edge peer to cause memory exhaustion and disrupt cloud-edge communication by sending crafted headers with excessive declared lengths.

• UNSCOREDCVE-2026-61674public exploit available2026-09-21
• MEDIUM 6.2CVE-2026-59168public exploit available2026-09-21

  The flaw allows deep nesting of JSON or XML data to exhaust the Go goroutine stack, leading to a fatal error. This matters because it can cause service disruption without proper mitigation.

• MEDIUM 6.1CVE-2026-58504public exploit available2026-09-21

  A vulnerability allows execution of attacker-controlled JavaScript when processing crafted .drawio files, potentially exposing sensitive data and cookies.

• MEDIUM 6CVE-2026-17051public exploit available2026-09-21

  This flaw allows an attacker to cause an out-of-bounds write by setting a length field in the doorbell register beyond the buffer size, leading to potential static memory corruption.

• MEDIUM 5.7CVE-2026-17050public exploit available2026-09-21

  This flaw allows a malicious USB device to cause a double-free vulnerability by manipulating descriptor responses during device enumeration, potentially leading to system instability or crashes.

• MEDIUM 4.3CVE-2026-88978public exploit available2026-09-21

  The flaw allows an authenticated tenant worker to retrieve durable event-log records from another tenant by exploiting a lack of tenant filter in the WorkerStatus gRPC polling path.

• CRITICAL 9.8CVE-2026-85751public exploit available2026-09-21

  The flaw allows an unauthenticated attacker to spoof trusted proxy identity and bypass authentication by manipulating the X-Forwarded-By header.

• LOW 3.1CVE-2026-84298public exploit available2026-09-21

  The flaw allows an authenticated tenant worker to intercept another tenant's task callback if they know the task UUID and keep a stream open on the same dispatcher process.

• HIGH 8.8CVE-2026-82412public exploit available2026-09-21

  The vulnerability allows any authenticated non-admin user to execute OS commands as the ntopng process account via crafted GET requests, leading to potential unauthorized access and control of the system.

• LOW 2.4CVE-2026-771662026-09-21
• MEDIUM 6.5CVE-2026-771652026-09-21

  Users could not unlock locks placed by other users, potentially leading to data loss or unavailability.

• MEDIUM 6.3CVE-2026-63342public exploit available2026-09-21

  The flaw allows an authenticated user to read another tenant's durable task event logs by exploiting a misconfigured API endpoint, potentially revealing sensitive workflow details.

• HIGH 7.1CVE-2026-61687public exploit available2026-09-21

  The flaw allows unauthenticated attackers to bind a victim's session to an attacker-controlled OAuth identity by exploiting an empty state parameter acceptance in ValidateOAuthState before version 0.91.1.

• MEDIUM 4.1CVE-2026-61681public exploit available2026-09-21

  The flaw allows an authenticated user to replace the UnsubscribeURL with an internal URL, leading to potential exposure of sensitive data and credentials.