Search
37,354 CVEs · High severity
CVEs (37,354, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 37,354 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-82863 | HIGH | Patched | 3.3 | 2026-08-31 | @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify… |
| CVE-2025-62840 | HIGH | Patched | 3.3 | 2026-01-02 | A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access… |
| CVE-2025-13053 | HIGH | Patched | 3.7 | 2025-12-12 | When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffi… |
| CVE-2026-75833 | HIGH | 4.2 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanit… | |
| CVE-2026-80197 | HIGH | Patched | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other … |
| CVE-2026-62354 | HIGH | Patched | 4.3 | 2026-08-03 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. T… |
| CVE-2026-67344 | HIGH | Patched | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which … |
| CVE-2026-87667 | HIGH | Patched | 4.5 | 2026-10-08 | An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Whe… |
| CVE-2026-72779 | HIGH | Patched | 4.5 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a… |
| CVE-2026-100640 | HIGH | 4.7 | 2026-09-26 | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking cli… | |
| CVE-2026-42789 | HIGH | Patched | 4.8 | 2026-05-27 | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermedia… |
| CVE-2026-13224 | HIGH | Patched | 4.9 | 2026-09-30 | A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by se… |
| CVE-2025-14432 | HIGH | Patched | 4.9 | 2025-12-16 | In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected… |
| CVE-2026-114110 | HIGH | Patched | 5.3 | 2026-10-21 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD … |
| CVE-2026-104438 | HIGH | Patched | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying re… |
| CVE-2026-104439 | HIGH | Patched | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through… |
| CVE-2026-43833 | HIGH | 5.3 | 2026-07-31 | A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution. | |
| CVE-2026-50738 | HIGH | Patched | 5.3 | 2026-07-28 | A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled du… |
| CVE-2026-65600 | HIGH | Patched | 5.3 | 2026-07-22 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When Rep… |
| CVE-2026-6966 | HIGH | Patched | 5.3 | 2026-04-24 | Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass t… |
| CVE-2026-67239 | HIGH | Patched | 5.4 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-manageme… |
| CVE-2026-77912 | HIGH | Patched | 5.4 | 2026-09-22 | A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into… |
| CVE-2026-7186 | HIGH | 5.4 | 2026-06-08 | Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions t… | |
| CVE-2026-8833 | HIGH | 5.4 | 2026-06-08 | Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated … | |
| CVE-2025-68954 | HIGH | Patched | 5.4 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server insta… |