CVE-2026-46582 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based… |
CVE-2026-65058 | Medium | 5.3 | 2026-07-21 | Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the… |
CVE-2026-49783 | High | 7.8 | 2026-07-14 | Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-54431 | | | 2026-07-02 | In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 sect… |
CVE-2026-12577 | | | 2026-07-01 | DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability. |
CVE-2026-57915 | High | 7.3 | 2026-06-26 | It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recomme… |
CVE-2026-48797 | | | 2026-06-17 | Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a trai… |
CVE-2026-50628 | Critical | 9.8 | 2026-06-12 | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP addres… |
CVE-2026-11127 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted W… |
CVE-2026-11122 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a cra… |
CVE-2026-44475 | Medium | 6.1 | 2026-05-27 | Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchReques… |
CVE-2026-44474 | Low | 3.7 | 2026-05-27 | Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures def… |
CVE-2026-44473 | High | 7.1 | 2026-05-27 | Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying… |
CVE-2026-42082 | Low | 3.7 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules de… |
CVE-2026-42081 | Medium | 6.1 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NG… |
CVE-2026-40597 | | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an atta… |
CVE-2026-44513 | High | 8.8 | 2026-05-14 | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary… |
CVE-2026-45109 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-… |
CVE-2026-28914 | Medium | 5.5 | 2026-05-11 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously craf… |
CVE-2025-31983 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious… |
CVE-2025-31970 | Medium | 5.3 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for… |
CVE-2026-22618 | Medium | 5.9 | 2026-04-16 | A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potent… |
CVE-2026-5894 | Medium | 4.3 | 2026-04-08 | Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page… |
CVE-2026-35679 | Low | 3.5 | 2026-04-05 | Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user f… |
CVE-2026-29103 | Critical | 9.1 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability… |
CVE-2026-2645 | High | 7.5 | 2026-03-19 | In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerif… |
CVE-2025-13333 | Medium | 4.4 | 2026-02-17 | IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings. |
CVE-2026-1486 | High | 8.8 | 2026-02-09 | A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enab… |
CVE-2025-66607 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
The response header
contains an insecure setting. Users could be red… |
CVE-2025-66603 | Critical | 9.8 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
The web server accepts
the OPTIONS method. An attacker could potenti… |
CVE-2025-66601 | Medium | 6.1 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product does not
specify MIME types. When an attacker performs… |
CVE-2025-66600 | | | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product lacks
HSTS (HTTP Strict Transport Security) configurati… |
CVE-2025-69234 | Critical | 9.1 | 2025-12-30 | Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment. |
CVE-2025-62002 | Medium | 4.3 | 2025-12-18 | BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large)… |
CVE-2025-66323 | Medium | 5.3 | 2025-12-08 | Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58308 | High | 7.3 | 2025-11-28 | Vulnerability of improper criterion security check in the call module.
Impact: Successful exploitation of this vulnerability may cause features to perform abno… |
CVE-2025-62585 | High | 7.5 | 2025-10-16 | Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment. |
CVE-2025-62583 | Critical | 9.8 | 2025-10-16 | Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment. |
CVE-2025-25255 | Medium | 5.3 | 2025-10-14 | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7… |
CVE-2025-31969 | Medium | 4.0 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come ac… |
CVE-2025-59147 | High | 7.5 | 2025-10-01 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and belo… |
CVE-2025-10457 | Medium | 4.3 | 2025-09-19 | The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a conne… |
CVE-2025-43262 | Medium | 5.1 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted Mode may not be applied to accessories co… |
CVE-2025-32086 | High | 7.2 | 2025-08-12 | Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX ma… |
CVE-2025-8204 | Low | 3.1 | 2025-07-26 | A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2024-55599 | Medium | 5.3 | 2025-07-08 | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all vers… |
CVE-2025-49011 | Low | 3.7 | 2025-06-06 | SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats… |
CVE-2025-3069 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
CVE-2021-26105 | Medium | 6.8 | 2025-03-24 | A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authe… |
CVE-2020-9295 | Medium | 4.7 | 2025-03-17 | FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version… |
CVE-2025-21267 | Medium | 4.4 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-12056 | | | 2024-12-04 | The Client secret is not checked when using the OAuth Password grant type.
By exploiting this vulnerability, an attacker could connect to a web server using a… |
CVE-2024-33510 | Medium | 4.3 | 2024-11-12 | An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below… |
CVE-2024-40650 | High | 7.8 | 2024-09-11 | In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege w… |
CVE-2024-36511 | Low | 3.7 | 2024-09-10 | An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions… |
CVE-2024-7965 | High | 8.8 | 2024-08-21 | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-41907 | Medium | 4.2 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missing general HTTP secu… |
CVE-2024-7003 | Medium | 4.3 | 2024-08-06 | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2024-6995 | Medium | 4.7 | 2024-08-06 | Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2024-5500 | Medium | 6.5 | 2024-07-16 | Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pag… |
CVE-2024-6772 | High | 8.8 | 2024-07-16 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
CVE-2024-6101 | High | 8.8 | 2024-06-20 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
CVE-2024-27842 | High | 7.8 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges. |
CVE-2024-2617 | High | 7.2 | 2024-04-30 | A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update,
if secure update feature was not enabled on… |
CVE-2024-3845 | Medium | 4.3 | 2024-04-17 | Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML pa… |
CVE-2024-3844 | Medium | 4.3 | 2024-04-17 | Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extens… |
CVE-2024-3838 | Medium | 5.5 | 2024-04-17 | Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform… |
CVE-2024-25545 | High | 7.8 | 2024-04-12 | An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component. |
CVE-2024-23592 | Medium | 6.3 | 2024-04-05 | An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with physical access to r… |
CVE-2024-2174 | High | 8.8 | 2024-03-06 | Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2023-2585 | Low | 3.5 | 2023-12-21 | Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof… |
CVE-2023-40445 | High | 7.5 | 2023-10-25 | The issue was addressed with improved UI handling. This issue is fixed in iOS 17.1 and iPadOS 17.1. A device may persistently fail to lock. |
CVE-2023-4501 | Critical | 9.8 | 2023-09-12 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enter… |
CVE-2023-3266 | Critical | 9.8 | 2023-08-14 | A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentic… |
CVE-2023-39403 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-28601 | High | 8.3 | 2023-06-13 | Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user ma… |
CVE-2023-28113 | Medium | 5.9 | 2023-03-16 | russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficien… |
CVE-2023-22393 | High | 7.5 | 2023-01-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in BGP route processing of Juniper Networks Junos OS and Junos OS Evolved allows an attac… |
CVE-2021-26328 | Medium | 4.4 | 2023-01-11 | Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
|
CVE-2022-38732 | High | 7.5 | 2022-09-29 | SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be p… |
CVE-2022-2324 | High | 7.5 | 2022-07-29 | Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. Th… |
CVE-2022-27220 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in… |
CVE-2022-27219 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in… |
CVE-2022-25152 | Critical | 9.9 | 2022-06-09 | The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory a… |
CVE-2021-42017 | Medium | 5.9 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGG… |
CVE-2022-22156 | Medium | 6.5 | 2022-01-19 | An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle (PitM) attacks when a system sc… |
CVE-2021-34791 | Medium | 4.7 | 2021-10-27 | Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) So… |
CVE-2021-34790 | Medium | 4.7 | 2021-10-27 | Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) So… |
CVE-2021-31375 | High | 7.2 | 2021-10-19 | An Improper Input Validation vulnerability in routing process daemon (RPD) of Juniper Networks Junos OS devices configured with BGP origin validation using Res… |
CVE-2020-10743 | Medium | 4.3 | 2021-06-02 | It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate… |
CVE-2020-1761 | Medium | 6.1 | 2021-05-27 | A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access… |
CVE-2021-3448 | Medium | 4.0 | 2021-04-08 | A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while fo… |
CVE-2021-21387 | High | 8.1 | 2021-03-19 | Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of v… |
CVE-2020-25686 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards… |
CVE-2020-25684 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destin… |
CVE-2020-8352 | Low | 2.4 | 2020-11-11 | In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes. |
CVE-2020-1728 | Medium | 4.8 | 2020-04-06 | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP securit… |
CVE-2020-7251 | Medium | 5.0 | 2020-02-14 | Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to… |
CVE-2019-14823 | High | 7.4 | 2019-10-14 | A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the r… |
CVE-2016-10834 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). |