CVE-2026-63650 | | | 2026-08-14 | OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup… |
CVE-2026-17566 | Critical | 9.9 | 2026-07-31 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the ren… |
CVE-2026-17351 | Critical | 9.0 | 2026-07-31 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exa… |
CVE-2026-42004 | Low | 3.7 | 2026-06-25 | An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client… |
CVE-2026-12491 | Medium | 4.8 | 2026-06-17 | A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specif… |
CVE-2025-68113 | Medium | 6.5 | 2025-12-16 | ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, w… |
CVE-2025-55303 | Medium | 6.1 | 2025-08-19 | Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with… |
CVE-2025-54584 | Medium | 5.7 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a m… |
CVE-2025-5826 | Medium | 6.3 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2025-5747 | High | 8.0 | 2025-06-06 | WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2025-32908 | High | 7.5 | 2025-04-14 | A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a… |
CVE-2024-11169 | High | 7.5 | 2025-03-20 | An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handl… |
CVE-2025-22870 | Medium | 4.4 | 2025-03-12 | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is s… |
CVE-2025-25069 | Medium | 6.5 | 2025-02-07 | A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.
Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests,
a valid HTTP r… |
CVE-2023-32228 | Medium | 4.6 | 2024-04-11 | A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user. |
CVE-2023-32260 | Medium | 6.5 | 2024-03-19 | Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud Ma… |
CVE-2023-0880 | High | 8.3 | 2023-02-17 | Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2022-20915 | High | 7.4 | 2022-10-10 | A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adj… |
CVE-2022-3224 | Medium | 6.1 | 2022-09-15 | Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0. |
CVE-2022-1233 | Medium | 6.1 | 2022-04-04 | URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2022-21672 | Medium | 6.5 | 2022-01-10 | make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make… |
CVE-2021-1587 | High | 8.6 | 2021-08-25 | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated… |
CVE-2021-21366 | Medium | 4.3 | 2021-03-12 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly pres… |
CVE-2021-0207 | High | 7.5 | 2021-01-15 | An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain tra… |
CVE-2020-27846 | Critical | 9.8 | 2020-12-21 | A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnera… |
CVE-2020-29511 | Critical | 9.8 | 2020-12-14 | The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which al… |
CVE-2020-29510 | Critical | 9.8 | 2020-12-14 | The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows… |
CVE-2020-29509 | Critical | 9.8 | 2020-12-14 | The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which… |
CVE-2018-12123 | Medium | 4.3 | 2018-11-28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is… |
CVE-2018-12116 | High | 7.5 | 2018-11-28 | Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for… |
CVE-2018-7159 | Medium | 5.3 | 2018-05-17 | The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interprete… |