CVE-2026-53789 | Medium | 6.5 | 2026-08-13 | rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intend… |
CVE-2026-64934 | Medium | 4.3 | 2026-08-11 | The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version… |
CVE-2026-19579 | Medium | 5.4 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_ad… |
CVE-2026-18705 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different… |
CVE-2026-58239 | Low | 3.7 | 2026-08-11 | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the… |
CVE-2026-9077 | High | 8.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server confi… |
CVE-2026-64827 | Critical | 9.8 | 2026-08-03 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where… |
CVE-2026-13059 | High | 8.1 | 2026-07-22 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due… |
CVE-2026-16093 | Medium | 5.4 | 2026-07-17 | Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication… |
CVE-2026-9561 | | | 2026-07-14 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log en… |
CVE-2026-48491 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNI… |
CVE-2026-48980 | Medium | 6.3 | 2026-06-18 | pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and… |
CVE-2026-53860 | Medium | 4.2 | 2026-06-16 | OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation… |
CVE-2026-12058 | | | 2026-06-12 | The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed. |
CVE-2026-44649 | Critical | 9.8 | 2026-05-29 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-43935 | High | 8.1 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the… |
CVE-2026-6213 | | | 2026-05-08 | A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local connection check and achieve arbitrary code execution as r… |
CVE-2026-24120 | Critical | 9.8 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to… |
CVE-2026-39807 | | | 2026-05-01 | Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connectio… |
CVE-2026-41403 | Low | 2.9 | 2026-04-28 | OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauth… |
CVE-2026-41390 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers b… |
CVE-2026-41380 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper car… |
CVE-2026-1789 | Medium | 4.9 | 2026-04-24 | A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device via crafted requests… |
CVE-2026-41299 | High | 7.1 | 2026-04-21 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-dec… |
CVE-2026-0390 | Medium | 6.7 | 2026-04-14 | Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. |
CVE-2019-25711 | Medium | 6.2 | 2026-04-12 | SpotFTP Password Recover 2.4.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized buffer… |
CVE-2026-35670 | Medium | 5.9 | 2026-04-10 | OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutabl… |
CVE-2026-35655 | Medium | 5.7 | 2026-04-10 | OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput an… |
CVE-2026-35624 | Medium | 4.2 | 2026-04-09 | OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Atta… |
CVE-2026-35617 | Medium | 4.2 | 2026-04-09 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. At… |
CVE-2026-34486 | High | 7.5 | 2026-04-09 | Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issu… |
CVE-2025-13926 | Critical | 9.8 | 2026-04-09 | An attacker could use data obtained by sniffing the network traffic to
forge packets in order to make arbitrary requests to Contemporary
Controls BASC 20T. |
CVE-2026-29134 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions. |
CVE-2026-32975 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable gro… |
CVE-2019-25621 | Medium | 6.2 | 2026-03-23 | Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyb… |
CVE-2019-25594 | Medium | 6.2 | 2026-03-22 | ASPRunner.NET 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in t… |
CVE-2019-25544 | Medium | 6.2 | 2026-03-21 | Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string… |
CVE-2026-32898 | Medium | 5.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall… |
CVE-2026-32057 | High | 7.1 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=co… |
CVE-2026-29794 | Medium | 5.3 | 2026-03-20 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass th… |
CVE-2026-33068 | High | 8.8 | 2026-03-20 | Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-controlled .claude/setting… |
CVE-2026-31892 | High | 8.1 | 2026-03-11 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user… |
CVE-2026-27707 | High | 7.3 | 2026-02-27 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authenticati… |
CVE-2026-21514 | High | 7.8 | 2026-02-10 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-25958 | High | 7.7 | 2026-02-09 | Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request w… |
CVE-2026-25931 | High | 7.8 | 2026-02-09 | vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configu… |
CVE-2026-21509 | High | 7.8 | 2026-01-26 | Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-23848 | Medium | 6.5 | 2026-01-19 | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing… |
CVE-2026-20849 | High | 7.5 | 2026-01-13 | Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
CVE-2025-65328 | Medium | 6.5 | 2026-01-05 | Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy ch… |
CVE-2025-66507 | High | 7.5 | 2025-12-09 | 1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA v… |
CVE-2025-66577 | Medium | 5.3 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-66570 | Critical | 10.0 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-10161 | High | 7.3 | 2025-11-11 | Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision… |
CVE-2025-12488 | Critical | 9.8 | 2025-11-06 | oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-12487 | Critical | 9.8 | 2025-11-06 | oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-11271 | Medium | 5.3 | 2025-11-06 | The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification by… |
CVE-2025-53717 | High | 7.0 | 2025-10-14 | Reliance on untrusted inputs in a security decision in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges… |
CVE-2025-59152 | High | 7.5 | 2025-10-06 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarde… |
CVE-2025-55736 | Medium | 6.5 | 2025-08-19 | flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete u… |
CVE-2025-55735 | Medium | 5.4 | 2025-08-19 | flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "… |
CVE-2025-53882 | Medium | 4.4 | 2025-07-23 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sen… |
CVE-2024-13974 | High | 8.1 | 2025-07-21 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’… |
CVE-2025-49827 | Critical | 9.8 | 2025-07-15 | Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets Manager, Self-Hosted (for… |
CVE-2024-55354 | High | 8.8 | 2025-04-08 | Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let a… |
CVE-2025-0117 | | | 2025-03-12 | A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrativ… |
CVE-2025-1969 | Medium | 4.3 | 2025-03-04 | Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof… |
CVE-2025-1126 | Critical | 9.3 | 2025-02-11 | A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client. |
CVE-2025-24369 | | | 2025-01-27 | Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scr… |
CVE-2024-52327 | Medium | 6.5 | 2025-01-23 | The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed. |
CVE-2024-9310 | | | 2025-01-22 | By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data can be transmitted to aircraft targets… |
CVE-2024-45654 | Medium | 4.3 | 2025-01-19 | IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs. |
CVE-2024-11146 | Medium | 6.3 | 2025-01-17 | TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal… |
CVE-2024-47254 | Medium | 6.3 | 2024-11-05 | In 2N Access Commander versions 3.1.1.2 and prior, an Insufficient
Verification of Data Authenticity vulnerability could allow an attacker
to escalate their… |
CVE-2024-51561 | High | 7.5 | 2024-11-04 | This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could e… |
CVE-2024-21510 | Medium | 5.4 | 2024-11-01 | Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When ma… |
CVE-2024-5754 | High | 8.2 | 2024-09-13 | BT: Encryption procedure host vulnerability |
CVE-2024-28829 | High | 7.8 | 2024-08-20 | Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL)… |
CVE-2024-7005 | Medium | 4.3 | 2024-08-06 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in… |
CVE-2024-29039 | Critical | 9.0 | 2024-06-28 | tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by alte… |
CVE-2024-28824 | High | 8.8 | 2024-03-22 | Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0… |
CVE-2023-46686 | Medium | 5.5 | 2023-12-18 |
A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to… |
CVE-2022-24400 | High | 7.5 | 2023-10-19 | A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero. |
CVE-2023-45128 | Critical | 10.0 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-0009 | High | 7.8 | 2023-06-14 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated p… |
CVE-2022-20744 | Medium | 6.5 | 2022-05-03 | A vulnerability in the input protection mechanisms of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view da… |
CVE-2021-36777 | High | 8.1 | 2022-03-09 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a… |
CVE-2021-41129 | High | 8.1 | 2021-10-06 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token`… |
CVE-2021-31999 | High | 8.8 | 2021-07-15 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the… |
CVE-2021-29479 | High | 7.0 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisonin… |
CVE-2020-5252 | Medium | 5.0 | 2020-03-23 | The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” co… |
CVE-2017-0887 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length… |