Search
16,920 CVEs · High severity
CVEs (16,920, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 16,920 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-82863 | HIGH | Patched | 3.3 | 2026-08-31 | @hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify… |
| CVE-2026-75833 | HIGH | 4.2 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanit… | |
| CVE-2026-80197 | HIGH | Patched | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other … |
| CVE-2026-62354 | HIGH | Patched | 4.3 | 2026-08-03 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. T… |
| CVE-2026-67344 | HIGH | Patched | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which … |
| CVE-2026-87667 | HIGH | Patched | 4.5 | 2026-10-08 | An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Whe… |
| CVE-2026-72779 | HIGH | Patched | 4.5 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a… |
| CVE-2026-100640 | HIGH | 4.7 | 2026-09-26 | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking cli… | |
| CVE-2026-13224 | HIGH | Patched | 4.9 | 2026-09-30 | A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by se… |
| CVE-2026-114110 | HIGH | Patched | 5.3 | 2026-10-21 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD … |
| CVE-2026-104438 | HIGH | Patched | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying re… |
| CVE-2026-104439 | HIGH | Patched | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through… |
| CVE-2026-43833 | HIGH | 5.3 | 2026-07-31 | A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution. | |
| CVE-2026-50738 | HIGH | Patched | 5.3 | 2026-07-28 | A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled du… |
| CVE-2026-67239 | HIGH | Patched | 5.4 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-manageme… |
| CVE-2026-77912 | HIGH | Patched | 5.4 | 2026-09-22 | A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into… |
| CVE-2026-111890 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions w… |
| CVE-2026-111891 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints… |
| CVE-2026-111885 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target gro… |
| CVE-2026-107211 | HIGH | Patched | 5.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index … |
| CVE-2026-107213 | HIGH | Patched | 5.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing witho… |
| CVE-2026-90913 | HIGH | Patched | 5.5 | 2026-09-29 | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthoriz… |
| CVE-2026-102569 | HIGH | 5.5 | 2026-09-29 | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into a… | |
| CVE-2026-100687 | HIGH | Patched | 5.5 | 2026-09-26 | Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attac… |
| CVE-2026-100629 | HIGH | Patched | 5.5 | 2026-09-26 | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assig… |