Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 451–475 of 172,839 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-92824 | MEDIUM | 6.2 | 2026-10-21 | A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the nu… | |
| CVE-2026-92823 | MEDIUM | 6.2 | 2026-10-21 | A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumula… | |
| CVE-2026-92822 | MEDIUM | 6.2 | 2026-10-21 | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers wi… | |
| CVE-2026-114118 | MEDIUM | 4.8 | 2026-10-21 | Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the bluep… | |
| CVE-2026-114116 | MEDIUM | Patched | 5.3 | 2026-10-21 | Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks… |
| CVE-2026-114115 | MEDIUM | 3.7 | 2026-10-21 | Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type'… | |
| CVE-2026-114114 | MEDIUM | Patched | 5.3 | 2026-10-21 | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so mul… |
| CVE-2026-114105 | MEDIUM | Patched | 6.2 | 2026-10-21 | Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOrigi… |
| CVE-2026-114103 | MEDIUM | 5.3 | 2026-10-21 | adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in … | |
| CVE-2026-114101 | MEDIUM | Patched | 4.0 | 2026-10-21 | Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us… |
| CVE-2026-114100 | MEDIUM | Patched | 5.8 | 2026-10-21 | Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-enc… |
| CVE-2026-114099 | MEDIUM | Patched | 5.8 | 2026-10-21 | Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct prope… |
| CVE-2026-114093 | MEDIUM | Patched | 4.3 | 2026-10-21 | Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based … |
| CVE-2026-114091 | MEDIUM | Patched | 5.3 | 2026-10-21 | Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An atta… |
| CVE-2026-114086 | MEDIUM | Patched | 5.3 | 2026-10-21 | Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run … |
| CVE-2026-114080 | MEDIUM | Patched | 5.0 | 2026-10-21 | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting un… |
| CVE-2026-114079 | MEDIUM | Patched | 5.4 | 2026-10-21 | Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments … |
| CVE-2026-114077 | MEDIUM | Patched | 7.1 | 2026-10-21 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without … |
| CVE-2026-114076 | MEDIUM | Patched | 5.4 | 2026-10-21 | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to intern… |
| CVE-2026-114075 | MEDIUM | Patched | 5.4 | 2026-10-21 | Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using th… |
| CVE-2026-114074 | MEDIUM | Patched | 5.4 | 2026-10-21 | Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the… |
| CVE-2026-114073 | MEDIUM | Patched | 5.5 | 2026-10-21 | Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unreda… |
| CVE-2026-114072 | MEDIUM | Patched | 4.3 | 2026-10-21 | The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the O… |
| CVE-2026-114070 | MEDIUM | Patched | 3.5 | 2026-10-21 | Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-reada… |
| CVE-2026-114064 | MEDIUM | Patched | 5.5 | 2026-10-21 | Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses,… |