Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 101–125 of 172,839 (capped at 500)
| CVE ID | Severity ↓ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115503 | MEDIUM | Patched | 5.5 | 2026-10-22 | Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk… |
| CVE-2026-115507 | MEDIUM | Patched | 3.5 | 2026-10-22 | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and … |
| CVE-2026-95718 | MEDIUM | 5.3 | 2026-10-22 | An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successf… | |
| CVE-2026-95719 | MEDIUM | 4.9 | 2026-10-22 | An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a… | |
| CVE-2026-95720 | MEDIUM | 4.4 | 2026-10-22 | A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation co… | |
| CVE-2026-95714 | MEDIUM | 6.8 | 2026-10-22 | A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Succe… | |
| CVE-2026-95715 | MEDIUM | 6.8 | 2026-10-22 | An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to e… | |
| CVE-2026-95716 | MEDIUM | 6.5 | 2026-10-22 | An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation … | |
| CVE-2026-95717 | MEDIUM | 5.5 | 2026-10-22 | A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges… | |
| CVE-2026-115517 | MEDIUM | — | 2026-10-22 | Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on execu… | |
| CVE-2026-115394 | MEDIUM | 5.5 | 2026-10-22 | Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via an unchecked 32-bit leng… | |
| CVE-2026-115395 | MEDIUM | Patched | 5.5 | 2026-10-22 | Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP entries to the images di… |
| CVE-2026-115396 | MEDIUM | Patched | 5.5 | 2026-10-22 | Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or comp… |
| CVE-2026-115397 | MEDIUM | Patched | 5.5 | 2026-10-22 | Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without… |
| CVE-2026-115387 | MEDIUM | Patched | 6.2 | 2026-10-22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic… |
| CVE-2026-115388 | MEDIUM | Patched | 6.2 | 2026-10-22 | wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing… |
| CVE-2026-115390 | MEDIUM | Patched | 5.7 | 2026-10-22 | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset … |
| CVE-2026-115391 | MEDIUM | Patched | 5.8 | 2026-10-22 | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-… |
| CVE-2026-115381 | MEDIUM | Patched | 4.8 | 2026-10-22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutpu… |
| CVE-2026-115382 | MEDIUM | Patched | 4.8 | 2026-10-22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Gues… |
| CVE-2026-115383 | MEDIUM | Patched | 4.8 | 2026-10-22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with… |
| CVE-2026-115385 | MEDIUM | Patched | 6.2 | 2026-10-22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the… |
| CVE-2026-115378 | MEDIUM | Patched | 5.8 | 2026-10-22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent t… |
| CVE-2026-115379 | MEDIUM | Patched | 5.7 | 2026-10-22 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm … |
| CVE-2026-115380 | MEDIUM | Patched | 4.0 | 2026-10-22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, … |