CVE-2026-100902 | Medium | 6.5 | 2026-09-28 | A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper… |
CVE-2026-87082 | High | 7.5 | 2026-09-22 | Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.
Neither backend chec… |
CVE-2026-87080 | Critical | 9.1 | 2026-09-22 | Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.
The pure-… |
CVE-2026-69211 | Medium | 4.8 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, an… |
CVE-2026-88260 | | | 2026-09-11 | Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8… |
CVE-2026-88009 | High | 8.2 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores i… |
CVE-2026-83611 | | | 2026-09-01 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, a… |
CVE-2026-72916 | | | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_addre… |
CVE-2026-0931 | | | 2026-08-05 | Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash… |
CVE-2026-25292 | High | 7.6 | 2026-08-04 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. |
CVE-2026-57026 | High | 7.5 | 2026-07-09 | An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series all… |
CVE-2026-55767 | Medium | 5.8 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants… |
CVE-2026-48059 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY p… |
CVE-2026-50131 | High | 8.6 | 2026-06-10 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg… |
CVE-2025-8873 | High | 7.5 | 2026-06-04 | On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The co… |
CVE-2019-25720 | Medium | 6.5 | 2026-06-03 | Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allow… |
CVE-2021-4479 | Medium | 4.0 | 2026-06-02 | Dräger Atlan A350 versions 1.00 up to and including 1.01 contains an improper input handling vulnerability that allows attackers to cause a denial of service b… |
CVE-2019-25723 | Medium | 4.0 | 2026-06-02 | Dräger Perseus A500 software versions 2.00 through 2.02 contains an improper input handling vulnerability that allows external attackers to cause a denial of s… |
CVE-2026-24092 | High | 7.2 | 2026-06-01 | Memory Corruption when processing fastboot commands to set display mode. |
CVE-2026-24091 | High | 7.2 | 2026-06-01 | Memory corruption while processing fastboot commands with improperly formatted input. |
CVE-2026-24089 | High | 7.2 | 2026-06-01 | Memory corruption while processing fastboot commands with invalid input. |
CVE-2026-24087 | High | 7.2 | 2026-06-01 | Memory corruption while processing fastboot OEM commands. |
CVE-2026-10099 | Medium | 4.0 | 2026-05-29 | XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause… |
CVE-2026-7307 | High | 7.5 | 2026-05-19 | A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoi… |
CVE-2026-0983 | | | 2026-05-18 | Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the… |
CVE-2026-42579 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 doma… |
CVE-2026-6918 | High | 7.5 | 2026-05-05 | In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message. |
CVE-2026-6442 | High | 8.3 | 2026-04-16 | Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attac… |
CVE-2026-40198 | High | 7.5 | 2026-04-10 | Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass.
_pack_ipv6() does not check that uncompressed… |
CVE-2026-33778 | High | 7.5 | 2026-04-09 | An Improper Validation of Syntactic Correctness of Input vulnerability in the IPsec library used by kmd and iked of Juniper Networks Junos OS on SRX Series an… |
CVE-2026-34835 | Medium | 4.8 | 2026-04-02 | Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using… |
CVE-2026-33218 | High | 7.5 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connec… |
CVE-2026-27889 | High | 7.5 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.1… |
CVE-2026-20114 | Medium | 5.4 | 2026-03-25 | A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privil… |
CVE-2025-13995 | Medium | 5.0 | 2026-03-19 | IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account. |
CVE-2026-3632 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate host… |
CVE-2026-25679 | High | 7.5 | 2026-03-06 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. |
CVE-2025-59785 | High | 7.2 | 2026-03-04 | Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption.
This… |
CVE-2025-13327 | Medium | 6.3 | 2026-02-27 | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zi… |
CVE-2026-21527 | Medium | 6.5 | 2026-02-10 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-25513 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2025-13878 | High | 7.5 | 2026-01-21 | Malformed BRID/HHIT records can cause `named` to terminate unexpectedly.
This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9… |
CVE-2026-0663 | Medium | 4.9 | 2026-01-21 | Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash th… |
CVE-2026-21917 | High | 7.5 | 2026-01-15 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthe… |
CVE-2025-67492 | Medium | 5.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook… |
CVE-2025-13033 | High | 7.5 | 2025-11-14 | A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit… |
CVE-2025-41719 | High | 8.8 | 2025-10-22 | A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion… |
CVE-2025-55085 | High | 7.5 | 2025-10-17 | In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bo… |
CVE-2025-11573 | High | 7.5 | 2025-10-09 | An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text inpu… |
CVE-2025-36262 | Medium | 4.9 | 2025-09-30 | IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13
could allow a malicious privileged user to bypass the UI to gain unauthorized acc… |
CVE-2025-10954 | Medium | 5.3 | 2025-09-27 | Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumber… |
CVE-2025-54995 | Medium | 6.5 | 2025-08-28 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can l… |
CVE-2025-25007 | Medium | 5.3 | 2025-08-12 | Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2024-51983 | High | 7.5 | 2025-06-25 | An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken v… |
CVE-2024-51982 | High | 7.5 | 2025-06-25 | An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target device. The device will… |
CVE-2025-30415 | High | 7.5 | 2025-06-04 | Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2025-43878 | Medium | 6.0 | 2025-05-07 | When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restri… |
CVE-2025-24348 | Medium | 5.4 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipul… |
CVE-2025-24347 | Medium | 6.5 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipul… |
CVE-2025-24346 | High | 7.5 | 2025-04-30 | A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/… |
CVE-2025-24345 | Medium | 6.3 | 2025-04-30 | A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “host… |
CVE-2025-46419 | Medium | 5.9 | 2025-04-24 | Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet. |
CVE-2024-52362 | Medium | 4.3 | 2025-03-12 | IBM App Connect Enterprise Certified Container 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3… |
CVE-2025-20644 | Medium | 6.5 | 2025-03-03 | In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2025-22868 | High | 7.5 | 2025-02-26 | An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. |
CVE-2025-24812 | Medium | 6.5 | 2025-02-11 | A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7… |
CVE-2025-0638 | High | 7.5 | 2025-01-22 | The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering ill… |
CVE-2024-8772 | Medium | 4.3 | 2024-11-26 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for… |
CVE-2024-8160 | Low | 3.8 | 2024-11-26 | Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a poss… |
CVE-2024-6763 | Low | 3.7 | 2024-10-14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The Htt… |
CVE-2024-6173 | Medium | 6.5 | 2024-09-10 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker… |
CVE-2024-7954 | Critical | 9.8 | 2024-08-23 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthentic… |
CVE-2024-39542 | High | 7.5 | 2024-07-11 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MPC… |
CVE-2024-6284 | High | 7.3 | 2024-07-03 | In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intend… |
CVE-2024-26507 | High | 7.8 | 2024-06-10 | An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to escalate privileg… |
CVE-2023-43850 | Medium | 6.5 | 2024-05-28 | Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to cause a part… |
CVE-2024-21598 | High | 7.5 | 2024-04-12 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved a… |
CVE-2024-3384 | High | 7.5 | 2024-04-10 | A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (N… |
CVE-2024-0218 | High | 7.5 | 2024-04-10 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functiona… |
CVE-2023-6950 | Low | 3.0 | 2024-04-02 | An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet co… |
CVE-2024-29041 | Medium | 6.1 | 2024-03-25 | Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open… |
CVE-2024-21616 | High | 7.5 | 2024-01-12 |
An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticate… |
CVE-2024-21595 | High | 7.5 | 2024-01-12 |
An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-bas… |
CVE-2023-44204 | Medium | 6.5 | 2023-10-13 |
An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2023-32649 | High | 7.5 | 2023-09-19 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence… |
CVE-2023-24015 | Medium | 4.3 | 2023-08-09 | A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name… |
CVE-2023-23903 | Medium | 4.9 | 2023-08-09 | An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every sub… |
CVE-2023-21405 | Medium | 6.5 | 2023-07-25 | Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network
Intercoms when communicating over OSDP, highlighting that the OSDP… |
CVE-2023-28985 | High | 7.5 | 2023-07-14 | An Improper Validation of Syntactic Correctness of Input vulnerability in Intrusion Detection and Prevention (IDP) of Juniper Networks SRX Series and MX Series… |
CVE-2023-27043 | Medium | 5.3 | 2023-04-19 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is ident… |
CVE-2021-44695 | Medium | 4.9 | 2022-12-13 | Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in th… |
CVE-2022-22192 | High | 7.5 | 2022-10-18 | An Improper Validation of Syntactic Correctness of Input vulnerability in the kernel of Juniper Networks Junos OS Evolved on PTX series allows a network-based… |
CVE-2022-1941 | High | 7.5 | 2022-09-22 | A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for pr… |
CVE-2022-22176 | High | 7.4 | 2022-01-19 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unau… |
CVE-2021-31988 | High | 8.8 | 2021-10-05 | A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) co… |
CVE-2021-31987 | High | 7.5 | 2021-10-05 | A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients. |
CVE-2021-28812 | High | 8.8 | 2021-06-03 | A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to ex… |
CVE-2020-16220 | Medium | 4.3 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions C.02, C.03,
PerformanceBridge Focal Point Version A.01, the product receives input
that is expected to be w… |