Search
43,412 CVEs
CVEs (43,412, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 43,412 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-112380 | CRITICAL | Patched | 9.9 | 2026-10-20 | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator… |
| CVE-2026-113708 | CRITICAL | Patched | 9.9 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query value… |
| CVE-2026-113709 | CRITICAL | Patched | 9.9 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm … |
| CVE-2026-113672 | CRITICAL | Patched | 9.9 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files wi… |
| CVE-2026-113506 | HIGH | 9.9 | 2026-10-20 | A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The… | |
| CVE-2026-113678 | CRITICAL | Patched | 9.9 | 2026-10-20 | Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary hos… |
| CVE-2026-113390 | HIGH | 9.9 | 2026-10-20 | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CG… | |
| CVE-2026-113391 | HIGH | 9.9 | 2026-10-20 | A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Uplo… | |
| CVE-2026-113389 | HIGH | 9.9 | 2026-10-20 | A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of t… | |
| CVE-2026-105312 | CRITICAL | 9.9 | 2026-10-20 | A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this ima… | |
| CVE-2026-112371 | HIGH | 9.9 | 2026-10-19 | A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation… | |
| CVE-2026-112370 | HIGH | 9.9 | 2026-10-19 | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os comman… | |
| CVE-2026-111406 | CRITICAL | 9.9 | 2026-10-19 | Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web … | |
| CVE-2026-110887 | CRITICAL | 9.9 | 2026-10-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a… | |
| CVE-2026-92262 | CRITICAL | Patched | 9.9 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affec… |
| CVE-2026-85746 | CRITICAL | Patched | 9.9 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an alloca… |
| CVE-2026-85748 | CRITICAL | Patched | 9.9 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can … |
| CVE-2026-105037 | CRITICAL | 9.9 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying a… | |
| CVE-2026-110812 | CRITICAL | Patched | 9.9 | 2026-10-15 | Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permi… |
| CVE-2026-57155 | CRITICAL | Patched | 9.9 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnse… |
| CVE-2026-108390 | CRITICAL | Patched | 9.9 | 2026-10-14 | Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escap… |
| CVE-2026-77524 | CRITICAL | Patched | 9.9 | 2026-10-14 | KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObjec… |
| CVE-2026-89310 | CRITICAL | 9.9 | 2026-10-14 | A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL stateme… | |
| CVE-2026-97381 | CRITICAL | Patched | 9.9 | 2026-10-13 | Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermit… |
| CVE-2026-106612 | CRITICAL | 9.9 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attack… |