01 Record index

CVE records

424,921 records indexed · sorted by most recently published

02 Records

CVE IDCVSSEPSSSeverityEXPLOITSummaryVendor / ProductPublished

CVE-2026-1267925.6—Medium—5.6—Medium—Heap overflow via oversized RSA signature in GCP KMS signing callbackmongodb libmongocrypt driver12 MIN AGO

CVE-2026-12727510.0—Critical—10.0—Critical—Linksys EA8100 JNAP API ui_server.lua SetUnsecuredWiFiWarning missing authenticationlinksys ea810020 MIN AGO

CVE-2026-1208689.3—Critical—9.3—Critical—Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gatewaycitrix netscaler adc citrix netscaler gateway26 MIN AGO

CVE-2026-1272746.3—Medium—6.3—Medium—Linksys EA8100 CheckAdminPassword excessive authenticationlinksys ea810035 MIN AGO

CVE-2026-1272735.3—Medium—5.3—Medium—Linksys EA8100 JNAP API IsAdminPasswordDefault missing authenticationlinksys ea810050 MIN AGO

CVE-2026-1280678.4—High—8.4—High—Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image sizepython-pillow pillow1 HR AGO

CVE-2026-1280668.7—High—8.7—High—Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag datapython-pillow pillow1 HR AGO

CVE-2026-1280656.9—Medium—6.9—Medium—@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not appliedgrpc grpc-node1 HR AGO

CVE-2026-1263674.8—Medium—4.8—Medium—@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternationgrpc grpc-node1 HR AGO

CVE-2026-1263667.5—High—7.5—High—msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOMmsgpack msgpack-ruby1 HR AGO

CVE-2026-1263655.4—Medium—5.4—Medium—Astro: XSS via unescaped code for unsupported languages in @astrojs/prism@astrojs markdoc @astrojs prism withastro astro1 HR AGO

CVE-2026-1263646.3—Medium—6.3—Medium—Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystemswithastro astro1 HR AGO

CVE-2026-933332.7—Low—2.7—Low—Vault audit device prefix vulnerable to log injectionhashicorp vault hashicorp vault enterprise1 HR AGO

CVE-2026-933356.5—Medium—6.5—Medium—Vault vulnerable to ACL deny bypass via trailing slashhashicorp vault hashicorp vault enterprise1 HR AGO

CVE-2026-1263632.3—Low—2.3—Low—Astro: Reflected XSS via unescaped slot names in @astrojs/solid-jswithastro astro1 HR AGO

CVE-2026-927355.9—Medium—5.9—Medium—Vault integrated storage join may disclose server environment credentialshashicorp vault hashicorp vault enterprise1 HR AGO

CVE-2026-1263622.3—Low—2.3—Low—Astro: Reflected XSS via unescaped slot names in @astrojs/sveltewithastro astro1 HR AGO

CVE-2026-1263612.3—Low—2.3—Low—Astro: XSS via attribute injection in dynamic tag nameswithastro astro1 HR AGO

CVE-2026-1263605.3—Medium—5.3—Medium—OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-apiopen-telemetry opentelemetry-python1 HR AGO

CVE-2026-1263593.4—Low—3.4—Low—Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injectionhonojs hono1 HR AGO

CVE-2026-1263585.3—Medium—5.3—Medium—Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminatorhonojs hono1 HR AGO

CVE-2026-1272125.3—Medium—5.3—Medium—Dokploy < 0.31.1 Broken Access Control via readAppMonitoringdokploy dokploy1 HR AGO

CVE-2026-1263575.3—Medium—5.3—Medium—Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefixhonojs hono1 HR AGO

CVE-2026-1263565.3—Medium—5.3—Medium—Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parametershonojs hono1 HR AGO

CVE-2026-1263555.3—Medium—5.3—Medium—Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)honojs hono1 HR AGO

CVE-2026-1263544.8—Medium—4.8—Medium—Addressable URI normalization resolves some dotted path segments to the wrong pathsporkmonger addressable1 HR AGO

CVE-2026-1263535.9—Medium—5.9—Medium—Addressable: Regular Expression Denial of Service in Addressable templates with several exploded variablessporkmonger addressable1 HR AGO

CVE-2026-1263525.9—Medium—5.9—Medium—Addressable: Regular Expression Denial of Service in Addressable templates with multiple variablessporkmonger addressable1 HR AGO

CVE-2026-1263515.9—Medium—5.9—Medium—Addressable: Denial of service in URI path normalizationsporkmonger addressable2 HR AGO

CVE-2026-1263505.9—Medium—5.9—Medium—Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressionssporkmonger addressable2 HR AGO

CVE-2026-1263493.1—Low—3.1—Low—Addressable display_uri can show misleading hosts containing bidi and invisible characterssporkmonger addressable2 HR AGO

CVE-2026-1263484.3—Medium—4.3—Medium—Addressable display_uri can show misleading hosts with invalid Punycode A-labelssporkmonger addressable2 HR AGO

CVE-2026-1263473.1—Low—3.1—Low—Tornado: Open redirect via triple-slash redirect pathstornadoweb tornado2 HR AGO

CVE-2026-1268237.3—High—7.3—High—Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dirmongodb atlas sql jdbc driver2 HR AGO

CVE-2026-1272117.1—High—7.1—High—MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Routemultivendorx multivendorx – woocommerce multivendor marketplace ai powered solutions2 HR AGO

CVE-2026-1263465.9—Medium—5.9—Medium—basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LFpatrickjuchli basic-ftp2 HR AGO

CVE-2026-1263455.3—Medium—5.3—Medium—basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()patrickjuchli basic-ftp2 HR AGO

CVE-2026-1263445.4—Medium—5.4—Medium—@hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checkshonojs node-server2 HR AGO

CVE-2026-1263435.3—Medium—5.3—Medium—@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the processhonojs node-server2 HR AGO

CVE-2026-1262105.3—Medium—5.3—Medium—@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxyhonojs node-server2 HR AGO

CVE-2026-1272095.1—Medium—5.1—Medium—Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivityxiaomi mi browser (com.mi.globalbrowser)2 HR AGO

CVE-2026-91141——Unrated———Unrated—CVE-2026-91141covesa vsomeip2 HR AGO

CVE-2026-1267938.6—High—8.6—High—Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapperaws aws-advanced-go-wrapper3 HR AGO

CVE-2026-1262095.3—Medium—5.3—Medium—Loofah allowed_uri? treats javascript&#x3a alert(1) as safeflavorjones loofah3 HR AGO

CVE-2026-1262084.7—Medium—4.7—Medium—Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restrictionflavorjones loofah3 HR AGO

CVE-2026-1272088.6—High—8.6—High—datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotationdatamodel-code-generator datamodel-code-generator3 HR AGO

CVE-2026-1262074.7—Medium—4.7—Medium—Loofah: CSS url() sanitization bypass via escaped parenthesesflavorjones loofah3 HR AGO

CVE-2026-1262065.3—Medium—5.3—Medium—Loofah allowed_uri? treats data:text/html as safe text/plainflavorjones loofah3 HR AGO

CVE-2026-1060188.7—High—8.7—High—Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. This issue affects EasyIO FW: through 3.0b25.johnson controls easyio fw3 HR AGO

CVE-2026-1272075.3—Medium—5.3—Medium—Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actionssendcloud sendcloud for woocommerce: automated shipping, branded tracking & returns3 HR AGO