CVE-2026-44091 | Critical | 9.1 | 2026-07-30 | An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration… |
CVE-2026-65902 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the upon… |
CVE-2026-49458 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-or… |
CVE-2026-48746 | Critical | 9.1 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on… |
CVE-2026-33828 | High | 7.8 | 2026-06-09 | Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally. |
CVE-2026-35051 | Critical | 10.0 | 2026-04-30 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traef… |
CVE-2026-34780 | High | 8.3 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-a… |
CVE-2026-24153 | Medium | 5.2 | 2026-03-31 | NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled. A successful exploit of this vulnerability might lead… |
CVE-2026-27893 | High | 8.8 | 2026-03-27 | vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation file… |
CVE-2026-4687 | High | 8.6 | 2026-03-24 | Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 14… |
CVE-2026-25725 | Critical | 10.0 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing mechanism failed to properly protect the .claude/settings.js… |
CVE-2025-14542 | High | 7.5 | 2025-12-13 | The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially se… |
CVE-2025-64496 | High | 7.3 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerab… |
CVE-2025-61884 | High | 7.5 | 2025-10-12 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-49714 | High | 7.8 | 2025-07-08 | Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally. |
CVE-2025-48938 | Critical | 9.8 | 2025-05-30 | go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 wh… |
CVE-2025-1118 | Medium | 4.4 | 2025-02-19 | A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attac… |
CVE-2024-49050 | High | 8.8 | 2024-11-12 | Visual Studio Code Python Extension Remote Code Execution Vulnerability |
CVE-2024-3661 | High | 7.6 | 2024-05-06 | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traff… |
CVE-2024-20265 | Medium | 5.9 | 2024-03-27 | A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot funct… |
CVE-2024-1725 | Medium | 6.5 | 2024-03-07 | A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to ga… |
CVE-2024-23682 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An atta… |
CVE-2023-49788 | High | 7.2 | 2023-12-08 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CO… |
CVE-2023-0627 | Medium | 6.7 | 2023-09-25 | Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affect… |
CVE-2023-28597 | High | 8.3 | 2023-03-27 | Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later… |
CVE-2023-0629 | High | 7.1 | 2023-03-13 | Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.soc… |
CVE-2022-20826 | Medium | 6.4 | 2022-11-15 | A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Ci… |
CVE-2022-1799 | Medium | 5.7 | 2022-07-29 | Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted by the SDK for devi… |
CVE-2020-4077 | High | 7.7 | 2020-07-07 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can rea… |
CVE-2020-4076 | High | 7.8 | 2020-07-07 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can rea… |
CVE-2020-15096 | Medium | 6.8 | 2020-07-07 | In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in… |
CVE-2019-0035 | Medium | 6.8 | 2019-04-10 | When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set sy… |