Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 126–150 of 172,839 (capped at 500)
| CVE ID | Severity ↓ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115370 | MEDIUM | Patched | 4.3 | 2026-10-22 | Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migr… |
| CVE-2026-115359 | MEDIUM | Patched | 3.7 | 2026-10-22 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded… |
| CVE-2026-115360 | MEDIUM | Patched | 4.7 | 2026-10-22 | OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC li… |
| CVE-2026-115356 | MEDIUM | Patched | 5.4 | 2026-10-22 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account token originally used to a… |
| CVE-2026-114655 | MEDIUM | 5.9 | 2026-10-22 | libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS resp… | |
| CVE-2026-115350 | MEDIUM | Patched | 6.1 | 2026-10-22 | Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens… |
| CVE-2026-115351 | MEDIUM | Patched | 4.7 | 2026-10-22 | Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unval… |
| CVE-2026-114651 | MEDIUM | 4.0 | 2026-10-22 | A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when spe… | |
| CVE-2026-114654 | MEDIUM | 6.5 | 2026-10-22 | A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to… | |
| CVE-2026-114645 | MEDIUM | 5.2 | 2026-10-22 | A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively… | |
| CVE-2026-114646 | MEDIUM | 6.5 | 2026-10-22 | A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object… | |
| CVE-2026-114647 | MEDIUM | 4.3 | 2026-10-22 | The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An a… | |
| CVE-2026-114650 | MEDIUM | 5.9 | 2026-10-22 | A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption… | |
| CVE-2026-114643 | MEDIUM | 5.4 | 2026-10-22 | The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application t… | |
| CVE-2026-113876 | MEDIUM | 4.3 | 2026-10-22 | SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whos… | |
| CVE-2026-54532 | MEDIUM | 6.9 | 2026-10-22 | CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token t… | |
| CVE-2026-77156 | MEDIUM | 6.4 | 2026-10-22 | Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the S… | |
| CVE-2026-77157 | MEDIUM | 6.4 | 2026-10-22 | ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by th… | |
| CVE-2026-114609 | MEDIUM | Patched | 5.8 | 2026-10-22 | fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supp… |
| CVE-2026-114610 | MEDIUM | Patched | 6.5 | 2026-10-22 | fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to GraphicsContext.add_item(), whose d… |
| CVE-2026-13599 | MEDIUM | 7.8 | 2026-10-22 | Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0. | |
| CVE-2026-108360 | MEDIUM | Patched | 6.4 | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates onl… |
| CVE-2026-115502 | MEDIUM | — | 2026-10-22 | A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same lin… | |
| CVE-2026-115513 | MEDIUM | Patched | 8.7 | 2026-10-22 | OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a … |
| CVE-2026-114606 | MEDIUM | Patched | — | 2026-10-22 | draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main proce… |