CVE-2026-85044 | | | 2026-09-03 | Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web… |
CVE-2026-19538 | | | 2026-08-26 | The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or T… |
CVE-2026-79010 | Medium | 4.3 | 2026-08-25 | Operation on a resource after expiration or release in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the render… |
CVE-2026-44725 | Medium | 6.6 | 2026-08-20 | EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the pl… |
CVE-2026-52733 | Medium | 6.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment… |
CVE-2026-50575 | High | 7.7 | 2026-08-18 | BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthentica… |
CVE-2026-68481 | High | 7.5 | 2026-08-06 | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The sa… |
CVE-2026-42955 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found… |
CVE-2026-47087 | Low | 3.5 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorize… |
CVE-2026-58291 | Medium | 6.1 | 2026-07-03 | Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-56314 | High | 7.1 | 2026-06-22 | Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. At… |
CVE-2026-2379 | Medium | 5.9 | 2026-06-05 | On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases… |
CVE-2026-33463 | Medium | 5.3 | 2026-05-28 | Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration ti… |
CVE-2026-42791 | Low | 3.7 | 2026-05-27 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certi… |
CVE-2026-33278 | Critical | 9.8 | 2026-05-20 | NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote cod… |
CVE-2026-32244 | Medium | 5.3 | 2026-05-19 | Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak… |
CVE-2026-4053 | Low | 3.1 | 2026-05-15 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user t… |
CVE-2026-45005 | Medium | 6.0 | 2026-05-11 | OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. A… |
CVE-2013-10075 | Critical | 9.1 | 2026-05-08 | Apache::Session versions through 1.94 for Perl re-creates deleted sessions.
The session stores Apache::Session::Store::File and Apache::Session::Store::DB_Fil… |
CVE-2026-43585 | High | 8.1 | 2026-05-06 | OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTT… |
CVE-2026-1629 | Medium | 4.3 | 2026-03-16 | Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue vie… |
CVE-2026-31875 | Medium | 5.9 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor au… |
CVE-2026-30978 | High | 7.8 | 2026-03-10 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXf… |
CVE-2026-23111 | High | 7.8 | 2026-02-13 | In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
nft_map_c… |
CVE-2026-1237 | | | 2026-01-28 | Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database recor… |
CVE-2025-69415 | High | 7.1 | 2026-01-02 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is curre… |
CVE-2025-58149 | High | 7.5 | 2025-10-31 | When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have. As a
result a doma… |
CVE-2025-55669 | High | 7.5 | 2025-10-15 | When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Tra… |
CVE-2025-10060 | Medium | 6.5 | 2025-09-05 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and serve… |
CVE-2025-39698 | High | 7.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved:
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
The io_futex_data is… |
CVE-2025-53901 | Low | 3.5 | 2025-07-18 | Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions c… |
CVE-2025-38290 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix node corruption in ar->arvifs list
In current WLAN recovery code flow… |
CVE-2025-6031 | High | 7.5 | 2025-06-12 | Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported.
When a user powers o… |
CVE-2025-31253 | High | 7.1 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may n… |
CVE-2025-2517 | | | 2025-04-21 | Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager. |
CVE-2025-30351 | Low | 3.5 | 2025-03-26 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can… |
CVE-2025-21117 | Medium | 6.6 | 2025-02-05 | Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vul… |
CVE-2024-57929 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved:
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
When dm_bm_read… |
CVE-2024-47571 | High | 8.1 | 2025-01-14 | An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate vi… |
CVE-2025-22149 | | | 2025-01-09 | JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full re… |
CVE-2024-56674 | Medium | 5.5 | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved:
virtio_net: correct netdev_tx_reset_queue() invocation point
When virtnet_close is follow… |
CVE-2024-49955 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
ACPI: battery: Fix possible crash when unregistering a battery hook
When a battery hook r… |
CVE-2024-49953 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
The km.state is not ch… |
CVE-2024-39792 | High | 7.5 | 2024-08-14 | When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software v… |
CVE-2024-31895 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IB… |
CVE-2024-31894 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IB… |
CVE-2024-31893 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token… |
CVE-2021-47294 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
netrom: Decrease sock refcount when sock timers expire
Commit 63346650c1a9 ("netrom: swit… |
CVE-2024-4693 | Medium | 5.5 | 2024-05-14 | A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads… |
CVE-2024-27308 | High | 7.5 | 2024-03-06 | Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes… |
CVE-2021-47069 | High | 7.8 | 2024-03-01 | In the Linux kernel, the following vulnerability has been resolved:
ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry
do_mq_timedrecei… |
CVE-2023-48220 | Medium | 5.7 | 2024-02-20 | Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allow… |
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2018-25098 | Medium | 4.3 | 2024-02-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in blockmason credit-protocol. It has been declared as problematic. Affected by this vulnerability is… |
CVE-2024-23638 | Medium | 6.5 | 2024-01-24 | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against C… |
CVE-2024-23332 | Medium | 4.0 | 2024-01-19 | The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic co… |
CVE-2023-34326 | High | 7.8 | 2024-01-05 | The caching invalidation guidelines from the AMD-Vi specification (48882—Rev
3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction
(see… |
CVE-2023-41094 | Critical | 10.0 | 2023-10-04 | TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet… |
CVE-2023-42446 | Medium | 6.5 | 2023-09-18 | Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store… |
CVE-2023-1902 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to… |
CVE-2023-1901 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller… |
CVE-2022-42838 | Low | 3.3 | 2023-02-27 | An issue with app access to camera data was addressed with improved logic. This issue is fixed in macOS Ventura 13. A camera extension may be able to continue… |
CVE-2022-22755 | High | 8.8 | 2022-12-22 | By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the sam… |
CVE-2022-45292 | Medium | 5.3 | 2022-12-09 | User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted. |
CVE-2022-30256 | High | 7.5 | 2022-11-19 | An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be re… |
CVE-2022-27499 | Low | 2.5 | 2022-11-11 | Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosur… |
CVE-2022-2447 | Medium | 6.6 | 2022-09-01 | A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from… |
CVE-2021-42778 | Medium | 5.3 | 2022-04-18 | A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo. |
CVE-2022-22197 | High | 7.5 | 2022-04-14 | An Operation on a Resource after Expiration or Release vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved all… |
CVE-2021-33020 | High | 8.2 | 2022-04-01 | Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increa… |
CVE-2022-22332 | High | 7.5 | 2022-04-01 | IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-… |
CVE-2021-37204 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9… |
CVE-2021-37185 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl… |
CVE-2021-23995 | High | 8.8 | 2021-06-24 | When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been expl… |
CVE-2020-13530 | High | 7.5 | 2020-12-11 | A denial-of-service vulnerability exists in the Ethernet/IP server functionality of the EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A large numb… |
CVE-2020-15270 | Medium | 4.3 | 2020-10-22 | Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessi… |
CVE-2020-25221 | High | 7.8 | 2020-09-10 | get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate… |
CVE-2020-24030 | Critical | 9.8 | 2020-09-02 | ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOT… |
CVE-2019-17638 | Critical | 9.4 | 2020-07-09 | In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error… |
CVE-2020-12043 | Critical | 9.8 | 2020-06-29 | The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operatio… |
CVE-2020-11044 | Low | 2.2 | 2020-05-07 | In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipu… |
CVE-2020-11027 | Medium | 6.1 | 2020-04-30 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email… |
CVE-2019-15794 | High | 7.1 | 2020-04-24 | Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file… |
CVE-2019-15791 | High | 7.1 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referenc… |
CVE-2019-20022 | Medium | 6.5 | 2019-12-27 | An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3. |
CVE-2019-15691 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routi… |
CVE-2019-19480 | Medium | 4.6 | 2019-12-01 | An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_pr… |
CVE-2017-14895 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving c… |
CVE-2017-0544 | High | 7.8 | 2017-04-07 | An elevation of privilege vulnerability in CameraBase could enable a local malicious application to execute arbitrary code. This issue is rated as High because… |
CVE-2009-3547 | High | 7.0 | 2009-11-04 | Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system… |