Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96418 | MEDIUM | Patched | 5.5 | 2026-09-29 | TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96417 | MEDIUM | Patched | 5.5 | 2026-09-29 | RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96416 | MEDIUM | Patched | 5.5 | 2026-09-29 | IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96415 | MEDIUM | Patched | 5.5 | 2026-09-29 | Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-9641 | MEDIUM | Patched | 5.3 | 2026-06-12 | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for l… |
| CVE-2026-96406 | MEDIUM | 4.9 | 2026-10-20 | A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure… | |
| CVE-2026-96405 | MEDIUM | 5.3 | 2026-10-21 | NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompress… | |
| CVE-2026-96402 | MEDIUM | — | 2026-10-20 | A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or f… | |
| CVE-2026-96400 | MEDIUM | Patched | 4.3 | 2026-10-06 | With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addres… |
| CVE-2026-96398 | MEDIUM | 4.3 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | |
| CVE-2026-96396 | MEDIUM | Patched | 4.9 | 2026-10-09 | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails an… |
| CVE-2026-96390 | MEDIUM | 4.3 | 2026-10-22 | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Ch… | |
| CVE-2026-9639 | MEDIUM | Patched | 6.5 | 2026-06-26 | Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions … |
| CVE-2026-96388 | MEDIUM | 5.4 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat applicat… | |
| CVE-2026-96386 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | |
| CVE-2026-96385 | MEDIUM | 6.5 | 2026-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects … | |
| CVE-2026-96382 | MEDIUM | 4.6 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba… | |
| CVE-2026-96380 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2. | |
| CVE-2026-96378 | MEDIUM | 4.3 | 2026-10-22 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affec… | |
| CVE-2026-96377 | MEDIUM | 5.3 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versi… | |
| CVE-2026-96376 | MEDIUM | 6.4 | 2026-10-22 | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Clo… | |
| CVE-2026-96375 | MEDIUM | 4.8 | 2026-10-22 | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1. | |
| CVE-2026-96374 | MEDIUM | 4.2 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.… | |
| CVE-2026-96372 | MEDIUM | 5.4 | 2026-10-22 | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | |
| CVE-2026-96371 | MEDIUM | 5.4 | 2026-10-22 | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. |