CVE-2026-59305 | Low | 3.1 | 2026-08-27 | Partition interceptor may be improperly added while sending message.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4… |
CVE-2026-68930 | Medium | 6.5 | 2026-08-03 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opene… |
CVE-2026-44108 | Critical | 9.8 | 2026-07-30 | Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window… |
CVE-2026-67217 | Medium | 5.3 | 2026-07-29 | cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value… |
CVE-2026-65100 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder o… |
CVE-2026-14169 | High | 8.1 | 2026-07-28 | Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwo… |
CVE-2026-56355 | Low | 3.7 | 2026-06-20 | GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization. |
CVE-2026-49318 | Low | 2.4 | 2026-05-29 | Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network at… |
CVE-2026-49317 | Low | 2.4 | 2026-05-29 | Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network at… |
CVE-2026-44919 | Medium | 4.3 | 2026-05-14 | In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL. |
CVE-2026-45033 | High | 7.8 | 2026-05-13 | GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub… |
CVE-2026-44600 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. |
CVE-2026-43002 | Medium | 5.3 | 2026-05-05 | An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and t… |
CVE-2026-40583 | High | 8.2 | 2026-04-21 | UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, n… |
CVE-2026-41254 | Medium | 4.0 | 2026-04-18 | Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. |
CVE-2026-35652 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action… |
CVE-2026-40223 | Medium | 4.7 | 2026-04-10 | In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running. |
CVE-2026-35640 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsi… |
CVE-2026-35637 | High | 7.3 | 2026-04-09 | OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final… |
CVE-2026-35636 | Medium | 6.5 | 2026-04-09 | OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session key… |
CVE-2026-35627 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation… |
CVE-2026-35386 | Low | 3.6 | 2026-04-02 | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username o… |
CVE-2026-33305 | Medium | 5.4 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optio… |
CVE-2025-9904 | Medium | 5.3 | 2025-09-29 | Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Print… |
CVE-2025-55114 | Medium | 5.3 | 2025-09-16 | The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake… |
CVE-2025-48965 | Medium | 4.0 | 2025-07-20 | Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater… |
CVE-2021-47688 | Medium | 5.7 | 2025-06-23 | In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functionality because a file can be truncated in… |
CVE-2025-20012 | Medium | 4.9 | 2025-05-13 | Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical a… |
CVE-2025-31485 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with… |
CVE-2025-0150 | High | 7.1 | 2025-03-11 | Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network ac… |
CVE-2023-52968 | Medium | 4.9 | 2025-03-08 | MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 cal… |
CVE-2024-45157 | Medium | 5.1 | 2024-09-05 | An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enablin… |
CVE-2024-24853 | High | 7.2 | 2024-08-14 | Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to poten… |
CVE-2024-35229 | Medium | 5.3 | 2024-05-27 | ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_… |
CVE-2024-30389 | Medium | 5.8 | 2024-04-12 | An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, networ… |
CVE-2024-30410 | Medium | 5.8 | 2024-04-12 | An Incorrect Behavior Order in the routing engine (RE) of Juniper Networks Junos OS on EX4300 Series allows traffic intended to the device to reach the RE inst… |
CVE-2023-23576 | Medium | 4.3 | 2023-12-18 |
Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a networ… |
CVE-2023-44386 | Medium | 5.3 | 2023-10-05 | Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler… |
CVE-2023-33224 | High | 7.2 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds… |
CVE-2021-22569 | High | 7.5 | 2022-01-10 | An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small ma… |
CVE-2021-31379 | High | 7.5 | 2021-10-19 | An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS allows an attacker to send certain malformed… |