Search
16,949 CVEs
CVEs (16,949, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 126–150 of 16,949 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-65422 | MEDIUM | 6.5 | 2026-09-24 | A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails. | |
| CVE-2026-6544 | MEDIUM | Patched | 6.2 | 2026-09-24 | IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files … |
| CVE-2026-73064 | LOW | 2.9 | 2026-09-24 | In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. Thi… | |
| CVE-2026-77703 | MEDIUM | Patched | 5.9 | 2026-09-24 | Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine… |
| CVE-2026-77707 | MEDIUM | Patched | 5.9 | 2026-09-24 | Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine: from 1.0 … |
| CVE-2026-77825 | MEDIUM | Patched | 4.9 | 2026-09-24 | IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement c… |
| CVE-2026-77874 | HIGH | 8.6 | 2026-09-24 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specia… | |
| CVE-2026-81539 | HIGH | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in… | |
| CVE-2026-81545 | HIGH | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements use… | |
| CVE-2026-81547 | HIGH | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal. | |
| CVE-2026-81548 | HIGH | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements use… | |
| CVE-2026-81549 | CRITICAL | 9.6 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header. | |
| CVE-2026-81552 | HIGH | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables. | |
| CVE-2026-82093 | HIGH | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data. | |
| CVE-2026-82094 | HIGH | 7.1 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a … | |
| CVE-2026-88351 | CRITICAL | 9.8 | 2026-09-24 | An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with… | |
| CVE-2026-90481 | NONE | Patched | — | 2026-09-24 | In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel. |
| CVE-2026-90959 | HIGH | 8.1 | 2026-09-24 | A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a l… | |
| CVE-2026-97224 | MEDIUM | 4.3 | 2026-09-24 | A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Import… | |
| CVE-2026-97362 | HIGH | 7.5 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by s… | |
| CVE-2026-97404 | NONE | Patched | — | 2026-09-24 | In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote att… |
| CVE-2025-32000 | MEDIUM | 4.3 | 2026-09-24 | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly truste… | |
| CVE-2026-56737 | HIGH | Patched | 8.1 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an … |
| CVE-2026-56739 | NONE | Patched | — | 2026-09-24 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating … |
| CVE-2026-63203 | HIGH | Patched | 7.6 | 2026-09-24 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-part… |