CVE-2026-107284 | Low | 3.7 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16… |
CVE-2026-106586 | Low | 2.5 | 2026-10-06 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerabi… |
CVE-2026-102124 | Medium | 6.5 | 2026-09-30 | A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with n… |
CVE-2026-102110 | Medium | 5.9 | 2026-09-30 | An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the ini… |
CVE-2026-98164 | High | 7.1 | 2026-09-29 | In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() check… |
CVE-2026-96760 | Critical | 9.8 | 2026-09-28 | Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization… |
CVE-2026-98051 | Medium | 5.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
The loop initialised nex… |
CVE-2026-92932 | | | 2026-09-17 | In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-bas… |
CVE-2026-73468 | Medium | 6.5 | 2026-09-16 | A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast tr… |
CVE-2026-55624 | | | 2026-08-25 | MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blo… |
CVE-2026-72705 | Medium | 6.3 | 2026-08-24 | The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument… |
CVE-2026-72704 | Medium | 6.3 | 2026-08-24 | The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by tra… |
CVE-2026-72703 | Medium | 6.3 | 2026-08-24 | The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoin… |
CVE-2026-19487 | Medium | 5.3 | 2026-08-13 | Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_fi… |
CVE-2026-73283 | Low | 2.5 | 2026-08-11 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. |
CVE-2026-20713 | | | 2026-08-11 | Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. System software advers… |
CVE-2026-16392 | Critical | 9.1 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-14935 | Low | 3.7 | 2026-07-07 | A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to a… |
CVE-2026-56328 | Medium | 6.5 | 2026-06-30 | Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultC… |
CVE-2026-7656 | High | 8.1 | 2026-06-29 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that… |
CVE-2026-55276 | Critical | 9.1 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when… |
CVE-2026-53404 | High | 7.3 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequen… |
CVE-2026-56307 | Medium | 4.3 | 2026-06-20 | Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authentic… |
CVE-2026-12321 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-48844 | High | 7.5 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection… |
CVE-2026-20171 | Medium | 6.8 | 2026-05-20 | A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switche… |
CVE-2026-38361 | High | 7.5 | 2026-05-08 | Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httpreques… |
CVE-2026-44928 | Low | 2.9 | 2026-05-08 | In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. |
CVE-2026-41988 | Low | 3.2 | 2026-04-23 | uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which i… |
CVE-2026-35343 | Low | 3.3 | 2026-04-22 | The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementati… |
CVE-2026-41527 | Medium | 6.9 | 2026-04-21 | KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueSer… |
CVE-2026-40942 | | | 2026-04-21 | The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadat… |
CVE-2026-6608 | Medium | 5.3 | 2026-04-20 | A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulat… |
CVE-2026-40960 | High | 8.1 | 2026-04-16 | Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods or secure.http_mods… |
CVE-2026-40719 | High | 7.5 | 2026-04-15 | Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver address cannot be resolved. |
CVE-2026-40396 | Medium | 4.0 | 2026-04-12 | Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 reque… |
CVE-2026-40394 | Medium | 4.0 | 2026-04-12 | Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of pref… |
CVE-2026-40200 | High | 8.1 | 2026-04-10 | An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implem… |
CVE-2026-34946 | High | 7.5 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilati… |
CVE-2026-35414 | Medium | 4.2 | 2026-04-02 | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Author… |
CVE-2026-35387 | Low | 3.1 | 2026-04-02 | OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterp… |
CVE-2025-58136 | High | 7.5 | 2026-04-02 | A bug in POST request handling causes a crash under a certain condition.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 thro… |
CVE-2026-33011 | High | 7.5 | 2026-03-20 | Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify… |
CVE-2026-32713 | Medium | 4.3 | 2026-03-16 | PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect bo… |
CVE-2026-1874 | High | 7.5 | 2026-03-03 | Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versio… |
CVE-2026-26267 | High | 7.5 | 2026-02-19 | soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up f… |
CVE-2025-33199 | Low | 3.2 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this v… |
CVE-2025-32942 | High | 7.2 | 2025-10-02 | SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic. |
CVE-2025-43359 | Critical | 9.8 | 2025-09-15 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS So… |
CVE-2025-38291 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
Currently, w… |
CVE-2025-49091 | High | 8.2 | 2025-06-11 | KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet://… |
CVE-2025-32996 | Medium | 4.0 | 2025-04-15 | In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. |
CVE-2025-2886 | Medium | 4.5 | 2025-03-27 | Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation… |
CVE-2025-29312 | Critical | 9.1 | 2025-03-24 | An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect t… |
CVE-2022-49393 | High | 7.8 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl
This is another instance o… |
CVE-2025-24800 | | | 2025-01-28 | Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, th… |
CVE-2025-21607 | High | 7.5 | 2025-01-14 | Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of t… |
CVE-2024-53271 | High | 7.1 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This c… |
CVE-2024-53270 | High | 7.5 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when… |
CVE-2024-53269 | Medium | 4.5 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm wil… |
CVE-2024-53134 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved:
pmdomain: imx93-blk-ctrl: correct remove path
The check condition should be 'i < bc->onec… |
CVE-2024-52811 | High | 8.2 | 2024-11-25 | The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a… |
CVE-2024-8811 | High | 7.8 | 2024-11-22 | WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installa… |
CVE-2024-30133 | Medium | 5.3 | 2024-11-12 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during… |
CVE-2024-47745 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_pages sys… |
CVE-2024-38365 | High | 7.4 | 2024-10-11 | btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement… |
CVE-2024-25622 | Low | 3.1 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the res… |
CVE-2024-47168 | Medium | 4.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properl… |
CVE-2024-47763 | Medium | 5.5 | 2024-10-09 | Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime cras… |
CVE-2024-20480 | High | 8.6 | 2024-09-25 | A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow an unauthenticated… |
CVE-2024-45807 | High | 7.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs ar… |
CVE-2024-45298 | Medium | 4.3 | 2024-09-18 | Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up S… |
CVE-2024-45311 | High | 7.5 | 2024-09-02 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `… |
CVE-2024-45304 | Medium | 5.3 | 2024-08-31 | Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership tran… |
CVE-2024-5659 | Medium | 6.5 | 2024-06-14 | Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable fault(MNRF/A… |
CVE-2024-32896 | High | 7.8 | 2024-06-13 | there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n… |
CVE-2024-37153 | High | 7.5 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bu… |
CVE-2023-52781 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
The BOS descriptor defines… |
CVE-2023-52742 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
net: USB: Fix wrong-direction WARNING in plusb.c
The syzbot fuzzer detected a bug in the… |
CVE-2024-35195 | Medium | 5.6 | 2024-05-20 | Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cer… |
CVE-2024-35312 | Medium | 6.2 | 2024-05-17 | In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003. |
CVE-2024-35190 | Medium | 5.8 | 2024-05-17 | Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpo… |
CVE-2024-32971 | Critical | 9.0 | 2024-05-02 | Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Rout… |
CVE-2024-33431 | Medium | 6.5 | 2024-05-01 | An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file. |
CVE-2024-3376 | High | 7.3 | 2024-04-06 | A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file con… |
CVE-2024-30246 | High | 7.6 | 2024-03-29 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete… |
CVE-2023-46840 | Medium | 4.1 | 2024-03-20 | Incorrect placement of a preprocessor directive in source code results
in logic that doesn't operate as intended when support for HVM guests is
compiled out of… |
CVE-2024-0313 | Medium | 5.5 | 2024-03-14 | A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrary, if the victim is… |
CVE-2023-31211 | High | 8.8 | 2024-01-12 | Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials |
CVE-2023-49798 | Medium | 5.9 | 2023-12-09 | OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In… |
CVE-2023-41338 | Medium | 5.3 | 2023-09-08 | Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This is… |
CVE-2023-23623 | High | 7.5 | 2023-09-06 | Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval… |
CVE-2023-41058 | High | 7.5 | 2023-09-04 | Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain conditions of `Parse.Query`… |
CVE-2023-41052 | Low | 3.7 | 2023-09-04 | Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_… |
CVE-2023-40015 | Low | 3.7 | 2023-09-04 | Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right t… |
CVE-2023-41376 | High | 7.5 | 2023-08-29 | Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes. |
CVE-2023-28711 | Medium | 5.5 | 2023-08-11 | Insufficient control flow management in the Hyperscan Library maintained by Intel(R) before version 5.4.1 may allow an authenticated user to potentially enable… |
CVE-2023-39152 | Medium | 6.5 | 2023-07-26 | Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the bui… |
CVE-2023-32675 | Low | 3.7 | 2023-05-19 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to se… |
CVE-2023-30629 | High | 7.5 | 2023-04-24 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode… |