CVE-2026-104198 | Medium | 5.3 | 2026-10-15 | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token… |
CVE-2026-108969 | High | 7.3 | 2026-10-13 | A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is… |
CVE-2026-106252 | High | 8.8 | 2026-10-06 | Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a… |
CVE-2026-71892 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeyS… |
CVE-2026-101913 | | | 2026-09-28 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts rec… |
CVE-2026-101912 | | | 2026-09-28 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/c… |
CVE-2026-85292 | Medium | 4.8 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller compares the… |
CVE-2026-79913 | Medium | 6.5 | 2026-09-22 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.g… |
CVE-2026-93957 | Medium | 4.3 | 2026-09-20 | A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php… |
CVE-2026-71855 | Medium | 5.9 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash… |
CVE-2026-57222 | Medium | 5.3 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 a… |
CVE-2026-61795 | Medium | 6.8 | 2026-09-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/valida… |
CVE-2026-61672 | High | 7.1 | 2026-09-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied m… |
CVE-2026-90977 | Medium | 5.3 | 2026-09-18 | The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to… |
CVE-2026-20333 | High | 8.8 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall T… |
CVE-2026-92395 | Critical | 9.1 | 2026-09-16 | @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request… |
CVE-2026-92087 | High | 8.1 | 2026-09-16 | @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0… |
CVE-2026-91997 | Medium | 5.3 | 2026-09-15 | evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticate… |
CVE-2026-91851 | | | 2026-09-15 | Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag.
DashboardsController::listTemplates() all… |
CVE-2026-90711 | Critical | 9.1 | 2026-09-15 | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions… |
CVE-2026-49846 | High | 7.5 | 2026-09-11 | libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose… |
CVE-2026-64836 | High | 8.8 | 2026-09-10 | ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check… |
CVE-2026-56101 | Medium | 5.3 | 2026-09-08 | OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypt… |
CVE-2026-73309 | High | 7.4 | 2026-09-08 | XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token… |
CVE-2026-80227 | | | 2026-08-30 | Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and p… |
CVE-2026-18664 | Critical | 9.1 | 2026-08-26 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian system… |
CVE-2026-73258 | Medium | 6.5 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input proce… |
CVE-2026-75110 | Critical | 9.8 | 2026-08-17 | MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless… |
CVE-2026-50029 | Medium | 5.3 | 2026-08-14 | js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (obje… |
CVE-2026-20765 | Medium | 4.2 | 2026-08-11 | Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System so… |
CVE-2026-67207 | High | 8.8 | 2026-07-30 | Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access… |
CVE-2026-48032 | | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy… |
CVE-2026-65903 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions… |
CVE-2026-55771 | High | 8.8 | 2026-07-13 | CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the En… |
CVE-2026-22660 | High | 7.2 | 2026-07-10 | FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorizati… |
CVE-2026-59890 | Medium | 6.1 | 2026-07-08 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in ex… |
CVE-2026-14687 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the compone… |
CVE-2026-14686 | Low | 3.3 | 2026-07-05 | A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/o… |
CVE-2026-14617 | Low | 3.1 | 2026-07-03 | A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate… |
CVE-2026-10097 | High | 7.5 | 2026-06-25 | wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check… |
CVE-2026-49340 | High | 8.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` a… |
CVE-2026-44249 | High | 8.1 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an… |
CVE-2026-45569 | High | 8.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to blo… |
CVE-2026-45567 | High | 8.3 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnera… |
CVE-2026-47202 | | | 2026-05-26 | Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a J… |
CVE-2026-9369 | Medium | 5.3 | 2026-05-24 | A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the file hermes_cli/web_ser… |
CVE-2026-44196 | Critical | 9.1 | 2026-05-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacke… |
CVE-2026-35040 | Medium | 5.3 | 2026-04-09 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub… |
CVE-2026-34574 | Medium | 5.4 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authent… |
CVE-2026-34210 | High | 8.1 | 2026-03-31 | mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Repla… |
CVE-2026-32322 | Medium | 5.3 | 2026-03-13 | soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compa… |
CVE-2026-26275 | High | 7.5 | 2026-02-19 | httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to version 0.0.23 where Digest header verifica… |
CVE-2026-21691 | Medium | 5.4 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2025-20343 | High | 8.6 | 2025-11-05 | A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthe… |
CVE-2025-12192 | Medium | 5.3 | 2025-11-05 | The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares t… |
CVE-2025-47416 | | | 2025-09-09 | A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to unauthorized execution of an attacker-de… |
CVE-2025-9401 | Low | 3.7 | 2025-08-25 | A vulnerability has been found in HuangDou UTCMS 9. This vulnerability affects unknown code of the file app/modules/ut-frame/admin/login.php of the component L… |
CVE-2025-54336 | Critical | 9.8 | 2025-08-19 | In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker ca… |
CVE-2025-27909 | Medium | 5.4 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain… |
CVE-2025-48952 | Critical | 9.4 | 2025-07-04 | NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass pass… |
CVE-2025-4515 | Medium | 4.3 | 2025-05-10 | A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The ma… |
CVE-2025-3102 | High | 8.1 | 2025-04-10 | The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due… |
CVE-2024-5528 | Low | 3.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, wh… |
CVE-2024-53861 | Low | 2.2 | 2024-11-29 | pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`… |
CVE-2024-9681 | Medium | 6.5 | 2024-11-06 | When curl is asked to use HSTS, the expiry time for a subdomain might
overwrite a parent domain's cache entry, making it end sooner or later than
otherwise int… |
CVE-2024-39534 | Medium | 5.4 | 2024-10-11 | An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent att… |
CVE-2024-6641 | Medium | 5.3 | 2024-09-18 | The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This… |
CVE-2024-41657 | High | 8.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the… |
CVE-2024-41958 | Medium | 6.6 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechani… |
CVE-2024-32862 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. |
CVE-2024-24621 | Critical | 9.8 | 2024-07-25 | Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulne… |
CVE-2024-5217 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnera… |
CVE-2024-39742 | High | 8.1 | 2024-07-08 | IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vu… |
CVE-2024-38522 | Medium | 6.3 | 2024-06-28 | Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` websit… |
CVE-2024-4032 | High | 7.5 | 2024-06-17 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This… |
CVE-2021-47370 | Medium | 5.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved:
mptcp: ensure tx skbs always have the MPTCP ext
Due to signed/unsigned comparison, the ex… |
CVE-2024-34340 | Critical | 9.1 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their passw… |
CVE-2024-2223 | High | 8.1 | 2024-04-09 | An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigur… |
CVE-2024-28246 | Medium | 5.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist cert… |
CVE-2024-29026 | High | 8.2 | 2024-03-20 | Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy all… |
CVE-2023-45213 | Medium | 6.6 | 2024-02-06 |
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the de… |
CVE-2015-10129 | Low | 3.7 | 2024-02-04 | A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/i… |
CVE-2023-50940 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive in… |
CVE-2024-23903 | Medium | 5.3 | 2024-01-24 | Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expecte… |
CVE-2023-49994 | Medium | 5.5 | 2023-12-12 | Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. |
CVE-2023-46660 | Medium | 5.3 | 2023-10-25 | Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equ… |
CVE-2023-46658 | Medium | 5.3 | 2023-10-25 | Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook t… |
CVE-2023-46657 | Medium | 5.3 | 2023-10-25 | Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, po… |
CVE-2023-46656 | Medium | 5.3 | 2023-10-25 | Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected… |
CVE-2023-46009 | High | 7.8 | 2023-10-18 | gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c. |
CVE-2023-45133 | Critical | 9.3 | 2023-10-12 | Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to… |
CVE-2023-44378 | High | 7.1 | 2023-10-09 | gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct tw… |
CVE-2015-6964 | Medium | 5.3 | 2023-09-25 | MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fe… |
CVE-2023-23766 | Medium | 4.5 | 2023-09-22 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened P… |
CVE-2023-23845 | Medium | 6.8 | 2023-09-13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-23840 | Medium | 6.8 | 2023-09-13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-40271 | High | 7.5 | 2023-09-08 | In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selecte… |
CVE-2023-41936 | High | 7.5 | 2023-09-06 | Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, poten… |
CVE-2023-41935 | High | 7.5 | 2023-09-06 | Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the… |
CVE-2023-23765 | Medium | 4.8 | 2023-08-30 | An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened P… |