CVE-2026-110865 | High | 7.1 | 2026-10-14 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules he… |
CVE-2026-69979 | Medium | 5.5 | 2026-10-13 | Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally. |
CVE-2026-107352 | High | 7.7 | 2026-10-07 | Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS ac… |
CVE-2026-89039 | Medium | 6.5 | 2026-10-05 | A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of… |
CVE-2026-93353 | Low | 3.1 | 2026-09-24 | copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitra… |
CVE-2026-37008 | High | 8.1 | 2026-09-13 | CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-… |
CVE-2026-82754 | | | 2026-09-07 | Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an uninten… |
CVE-2026-82586 | | | 2026-09-07 | Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-fie… |
CVE-2026-86145 | High | 8.2 | 2026-09-05 | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size… |
CVE-2026-58428 | Medium | 6.5 | 2026-08-13 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
CVE-2026-66756 | Critical | 9.8 | 2026-07-30 | Improper Protection of Alternate Path vulnerability in Apache Tika.
This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1.
Users are recomme… |
CVE-2026-54423 | High | 8.2 | 2026-07-10 | In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to… |
CVE-2026-0268 | Medium | 4.4 | 2026-06-10 | A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.
This does… |
CVE-2026-0237 | High | 7.8 | 2026-05-13 | An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automati… |
CVE-2026-4913 | Medium | 5.7 | 2026-04-14 | Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has… |
CVE-2026-4270 | Medium | 5.5 | 2026-03-16 | Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may… |
CVE-2025-68939 | High | 8.2 | 2025-12-26 | Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. |
CVE-2025-4617 | | | 2025-11-14 | An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the s… |
CVE-2025-58079 | Medium | 4.3 | 2025-10-16 | Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applicati… |
CVE-2025-6250 | Medium | 6.7 | 2025-07-28 | Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the s… |
CVE-2025-49163 | Medium | 6.7 | 2025-06-03 | Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file. |
CVE-2025-49162 | Medium | 6.4 | 2025-06-03 | Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to c… |
CVE-2025-48828 | Critical | 9.0 | 2025-05-27 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template co… |
CVE-2025-48827 | Critical | 10.0 | 2025-05-27 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or late… |
CVE-2025-46655 | Medium | 4.9 | 2025-04-26 | CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain c… |
CVE-2025-46654 | Medium | 4.9 | 2025-04-26 | CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file tha… |
CVE-2024-58136 | Critical | 9.0 | 2025-04-10 | Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in Febru… |
CVE-2025-0113 | | | 2025-02-12 | A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from th… |
CVE-2024-8781 | | | 2024-11-18 | Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escala… |
CVE-2023-52952 | High | 8.5 | 2024-10-08 | A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435)… |
CVE-2024-8311 | Medium | 6.5 | 2024-09-12 | An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authe… |
CVE-2024-3927 | Medium | 5.3 | 2024-05-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submissi… |
CVE-2024-3460 | High | 7.4 | 2024-05-14 | In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window… |
CVE-2024-3459 | High | 8.4 | 2024-05-14 | KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF… |
CVE-2023-20272 | Medium | 6.7 | 2023-11-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files… |
CVE-2023-46176 | Medium | 6.7 | 2023-11-03 | IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID… |
CVE-2023-5165 | High | 7.1 | 2023-09-25 | Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible… |
CVE-2023-0629 | High | 7.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.soc… |
CVE-2022-1742 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operatin… |
CVE-2022-28782 | Medium | 4.6 | 2022-05-03 | Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Se… |
CVE-2022-24932 | Medium | 4.2 | 2022-03-10 | Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation befor… |
CVE-2021-3793 | Medium | 6.5 | 2021-11-12 | An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the sam… |
CVE-2019-18997 | Medium | 4.3 | 2019-12-18 | The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISim… |
CVE-2019-18996 | High | 7.1 | 2019-12-18 | Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially al… |