Search
3,173 CVEs
CVEs (3,173, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 3,173 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-65917 | HIGH | Patched | 8.8 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup hand… |
| CVE-2026-65916 | HIGH | Patched | 8.1 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kil… |
| CVE-2026-65914 | NONE | Patched | — | 2026-07-23 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp,… |
| CVE-2026-65913 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype pr… |
| CVE-2026-65912 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers… |
| CVE-2026-65911 | MEDIUM | 6.1 | 2026-07-23 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subseque… | |
| CVE-2026-65908 | HIGH | Patched | 8.6 | 2026-07-23 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open |
| CVE-2026-65907 | CRITICAL | Patched | 9.1 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible |
| CVE-2026-65906 | HIGH | Patched | 8.8 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible |
| CVE-2026-65904 | MEDIUM | 4.7 | 2026-07-23 | DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument… | |
| CVE-2026-65903 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers ca… |
| CVE-2026-65902 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeEleme… |
| CVE-2026-65901 | MEDIUM | 6.1 | 2026-07-23 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply… | |
| CVE-2026-65900 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to… |
| CVE-2026-65899 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bou… |
| CVE-2026-65898 | HIGH | Patched | 7.2 | 2026-07-23 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the s… |
| CVE-2026-65897 | HIGH | Patched | 8.8 | 2026-07-23 | Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invite… |
| CVE-2026-65896 | HIGH | Patched | 7.1 | 2026-07-23 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController… |
| CVE-2026-65895 | HIGH | Patched | 8.5 | 2026-07-23 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write pr… |
| CVE-2026-65763 | NONE | — | 2026-07-23 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9 - Improper validation of user inputs lead to a reflective XSS vulnerability. | |
| CVE-2026-65762 | NONE | — | 2026-07-23 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 1.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability. | |
| CVE-2026-65761 | NONE | — | 2026-07-23 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated S… | |
| CVE-2026-65760 | NONE | — | 2026-07-23 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in us… | |
| CVE-2026-65759 | NONE | — | 2026-07-23 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, ar… | |
| CVE-2026-65758 | NONE | — | 2026-07-23 | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenti… |