Search
13,088 CVEs
CVEs (13,088, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 13,088 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-82452 | CRITICAL | 9.8 | 2026-08-29 | rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures.… | |
| CVE-2026-82448 | CRITICAL | 9.8 | 2026-08-29 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. At… | |
| CVE-2026-14494 | CRITICAL | 9.8 | 2026-08-29 | The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is… | |
| CVE-2026-80725 | CRITICAL | 9.8 | 2026-08-29 | In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond… | |
| CVE-2026-16259 | CRITICAL | 9.8 | 2026-08-29 | The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester,… | |
| CVE-2026-10522 | CRITICAL | 9.8 | 2026-08-29 | The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attac… | |
| CVE-2026-51663 | CRITICAL | 9.8 | 2026-08-28 | Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-cl… | |
| CVE-2026-19286 | CRITICAL | Patched | 9.8 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint. |
| CVE-2026-82329 | CRITICAL | Patched | 9.8 | 2026-08-28 | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative … |
| CVE-2026-82277 | CRITICAL | 9.8 | 2026-08-28 | Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers … | |
| CVE-2026-82266 | CRITICAL | 9.8 | 2026-08-28 | Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can … | |
| CVE-2026-55559 | CRITICAL | Patched | 9.8 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through … |
| CVE-2026-51645 | CRITICAL | 9.8 | 2026-08-28 | Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative username via send… | |
| CVE-2026-51611 | CRITICAL | 9.8 | 2026-08-28 | Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a … | |
| CVE-2026-81578 | CRITICAL | Patched | 9.8 | 2026-08-28 | An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests t… |
| CVE-2026-37236 | CRITICAL | 9.8 | 2026-08-28 | grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowe… | |
| CVE-2026-37751 | CRITICAL | 9.8 | 2026-08-28 | An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary comman… | |
| CVE-2026-80714 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their … | |
| CVE-2026-80694 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects… | |
| CVE-2026-80681 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header poin… | |
| CVE-2026-80668 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer AP… | |
| CVE-2026-80673 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribu… | |
| CVE-2026-80674 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTE_LIST is san… | |
| CVE-2026-80634 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case … | |
| CVE-2026-80630 | CRITICAL | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Whene… |