Search
43,412 CVEs
CVEs (43,412, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 43,412 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-69083 | CRITICAL | 10.0 | 2026-08-03 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tok… | |
| CVE-2026-69084 | CRITICAL | Patched | 10.0 | 2026-08-03 | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle wi… |
| CVE-2026-69085 | CRITICAL | 10.0 | 2026-08-03 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly i… | |
| CVE-2026-33591 | CRITICAL | — | 2026-08-03 | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retr… | |
| CVE-2026-18452 | CRITICAL | 10.0 | 2026-07-31 | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control o… | |
| CVE-2026-66803 | CRITICAL | 10.0 | 2026-07-30 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-48449 | CRITICAL | Patched | 10.0 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Explo… |
| CVE-2026-67429 | CRITICAL | Patched | 10.0 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir … |
| CVE-2026-16326 | CRITICAL | Patched | 10.0 | 2026-07-29 | In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be us… |
| CVE-2026-54735 | CRITICAL | Patched | 10.0 | 2026-07-29 | Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpola… |
| CVE-2026-58162 | HIGH | Patched | 10.0 | 2026-07-29 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-57834 | HIGH | Patched | 10.0 | 2026-07-29 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through… |
| CVE-2026-58150 | HIGH | Patched | 10.0 | 2026-07-29 | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 th… |
| CVE-2026-33267 | HIGH | Patched | 10.0 | 2026-07-29 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users a… |
| CVE-2026-16498 | CRITICAL | Patched | 10.0 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user… |
| CVE-2026-65880 | NONE | — | 2026-07-28 | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that in… | |
| CVE-2026-11756 | CRITICAL | 10.0 | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R202… | |
| CVE-2026-16812 | CRITICAL | Patched | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. … |
| CVE-2026-115931 | CRITICAL | 9.9 | 2026-10-23 | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user … | |
| CVE-2026-115893 | CRITICAL | Patched | 9.9 | 2026-10-23 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more tha… |
| CVE-2026-115889 | CRITICAL | Patched | 9.9 | 2026-10-23 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in releas… |
| CVE-2026-53942 | CRITICAL | 9.9 | 2026-10-23 | Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain … | |
| CVE-2026-110243 | CRITICAL | 9.9 | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configurat… | |
| CVE-2026-107861 | CRITICAL | 9.9 | 2026-10-22 | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted… | |
| CVE-2026-114625 | CRITICAL | Patched | 9.9 | 2026-10-22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. … |