Vulnerability list

CVE-2026-45498 · 2026-09-02 · pending_review

Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

CVE-2026-32202 · 2026-09-02 · pending_review

Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-20805 · 2026-09-02 · pending_review

Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.

CVE-2025-55177 · 2026-10-08 · pending_review

Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processi…

CVE-2025-49706 · 2026-09-02 · pending_review

Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive informatio…

CVE-2025-43520 · 2026-10-07 · pending_review

Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.

CVE-2025-21590 · 2026-10-01 · pending_review

Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.

CVE-2024-9379 · 2026-10-01 · pending_review

Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL stat…

CVE-2024-50302 · 2026-10-15 · pending_review

The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.

CVE-2023-50224 · 2026-09-15 · pending_review

TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could …

CVE-2023-20269 · 2026-09-02 · pending_review

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify v…

CVE-2022-2586 · 2026-10-14 · pending_review

Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.

CVE-2022-24682 · 2026-09-04 · pending_review

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

CVE-2021-41379 · 2026-09-04 · pending_review

Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.

CVE-2021-34448 · 2026-09-04 · pending_review

Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.

CVE-2021-22175 · 2026-10-01 · pending_review

GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

CVE-2021-20023 · 2026-10-01 · pending_review

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain …

CVE-2020-3153 · 2026-09-03 · pending_review

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system…

CVE-2019-6693 · 2026-09-02 · pending_review

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

CVE-2019-5591 · 2026-09-04 · pending_review

Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol …

CVE-2018-6882 · 2026-10-01 · pending_review

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.

CVE-2018-19953 · 2026-10-01 · pending_review

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

CVE-2018-13374 · 2026-10-01 · pending_review

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request…

CVE-2016-3351 · 2026-09-03 · pending_review

An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's co…

CVE-2013-3900 · 2026-10-07 · pending_review

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

CVE-2013-0431 · 2026-10-02 · pending_review

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.

CVE-2010-0738 · 2026-10-02 · pending_review

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's …

CVE-2009-3960 · 2026-09-04 · pending_review

Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.

CVE-2008-4128 · 2026-09-02 · draft

Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "al…

CVE-2026-111390 · 2026-10-16 · auto

Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{e…

CVE-2026-110029 · 2026-10-16 · auto

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to p…

CVE-2026-109930 · 2026-10-16 · auto

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated atta…

CVE-2026-19621 · 2026-10-16 · auto

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning t…

CVE-2026-18799 · 2026-10-16 · auto

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker …

CVE-2026-18256 · 2026-10-16 · auto

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission …

CVE-2026-16251 · 2026-10-16 · auto

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a rem…

CVE-2026-110595 · 2026-10-16 · auto

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can …

CVE-2026-110594 · 2026-10-16 · auto

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers …

CVE-2026-110593 · 2026-10-16 · auto

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated or…

CVE-2026-107635 · 2026-10-16 · auto

Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocke…

CVE-2026-84721 · 2026-10-16 · auto

A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template…

CVE-2026-71461 · 2026-10-16 · auto

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph…

CVE-2026-27433 · 2026-10-16 · auto

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.

CVE-2025-12801 · 2026-10-16 · auto

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particu…

CVE-2024-8008 · 2026-10-16 · auto

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious acto…

CVE-2026-97790 · 2026-10-16 · auto

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

CVE-2026-96948 · 2026-10-16 · auto

Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

CVE-2026-96944 · 2026-10-16 · auto

Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.

CVE-2026-96938 · 2026-10-16 · auto

Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-96935 · 2026-10-16 · auto

Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.