Search
35,912 CVEs · Medium severity
CVEs (35,912, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 35,912 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-82041 | MEDIUM | Patched | 9.9 | 2026-10-02 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP … |
| CVE-2025-62718 | MEDIUM | Patched | 9.9 | 2026-04-09 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY … |
| CVE-2026-102780 | MEDIUM | Patched | 9.8 | 2026-10-05 | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both … |
| CVE-2026-68979 | MEDIUM | Patched | 9.8 | 2026-08-03 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values… |
| CVE-2026-21662 | MEDIUM | Patched | 9.8 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee:… |
| CVE-2026-66756 | MEDIUM | Patched | 9.8 | 2026-07-30 | Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgra… |
| CVE-2026-35052 | MEDIUM | Patched | 9.8 | 2026-04-06 | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly while using a r… |
| CVE-2020-36962 | MEDIUM | 9.8 | 2026-01-28 | Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers… | |
| CVE-2025-58053 | MEDIUM | Patched | 9.8 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request… |
| CVE-2025-62849 | MEDIUM | 9.8 | 2025-12-16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to execute unauth… | |
| CVE-2025-67727 | MEDIUM | Patched | 9.8 | 2025-12-12 | Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered i… |
| CVE-2025-66405 | MEDIUM | Patched | 9.8 | 2025-12-01 | Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the… |
| CVE-2025-66219 | MEDIUM | Patched | 9.8 | 2025-11-29 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vuln… |
| CVE-2025-12554 | MEDIUM | Patched | 9.8 | 2025-10-31 | Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12552 | MEDIUM | Patched | 9.8 | 2025-10-31 | Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2026-111809 | MEDIUM | Patched | 9.3 | 2026-10-21 | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 thr… |
| CVE-2026-81535 | MEDIUM | Patched | 9.1 | 2026-10-07 | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcp… |
| CVE-2026-89134 | MEDIUM | 9.1 | 2026-09-27 | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallbac… | |
| CVE-2026-72748 | MEDIUM | 9.1 | 2026-08-11 | AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitr… | |
| CVE-2025-68118 | MEDIUM | Patched | 9.1 | 2025-12-17 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Windows platforms… |
| CVE-2025-62608 | MEDIUM | Patched | 9.1 | 2025-11-21 | MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy … |
| CVE-2025-12642 | MEDIUM | 9.1 | 2025-11-03 | lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successf… | |
| CVE-2025-12217 | MEDIUM | Patched | 9.1 | 2025-10-25 | SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2026-75130 | MEDIUM | 9.0 | 2026-08-18 | Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsaniti… | |
| CVE-2026-18245 | MEDIUM | Patched | 9.0 | 2026-07-30 | Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user brow… |