CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
204905 CVEs matched. Showing 1–50 (page 1 of 4099).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-18897 |
UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow | HIGH | 8.7 | — | — | VulDB | 2026-08-05 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-18907 |
PathTravelsal Vulnerability in com.talpa.hibrowser | — | — | — | — | TECNOMobile | 2026-08-05 | — | — | raw · ⬇ |
CVE-2026-18896 |
lavkush-maurya Student-Registration-System changepass.php sql injection | MEDIUM | 5.3 | — | — | VulDB | 2026-08-05 | — | — | raw · ⬇ |
CVE-2026-18895 |
UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow | HIGH | 8.7 | — | — | VulDB | 2026-08-05 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-18859 |
ESAFENET CDG usbkey;logindojojs sql injection | MEDIUM | 6.9 | — | — | VulDB | 2026-08-05 | — | — | raw · ⬇ |
CVE-2026-18856 |
Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery | MEDIUM | 5.1 | — | — | VulDB | 2026-08-05 | — | — | raw · ⬇ |
CVE-2026-18854 |
Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection | MEDIUM | 6.9 | — | — | VulDB | 2026-08-05 | — | — | raw · ⬇ |
CVE-2026-46334 |
OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning | HIGH | 8.7 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-18853 |
ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal | MEDIUM | 4.8 | — | — | VulDB | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-45809 |
OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI | HIGH | 8.7 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-45705 |
OpenSIPS: OOB Read in Multipart Body Boundary Parsing | MEDIUM | 5.3 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18852 |
epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition | MEDIUM | 4.8 | — | — | VulDB | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18103 |
Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi | MEDIUM | 4.9 | — | — | redhat | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-45537 |
OpenSIPS: Global Buffer Overflow in construct_uri | CRITICAL | 9.1 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-18819 |
RackTables cross-site request forgery | MEDIUM | 5.3 | — | — | VulDB | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18818 |
Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization | MEDIUM | 5.3 | — | — | VulDB | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18817 |
Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization | LOW | 2.1 | — | — | VulDB | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-45103 |
OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow | HIGH | 7.5 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70594 |
Ghost: Session Fixation in Ghost Admin | MEDIUM | 6.7 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-70593 |
Ghost: Theme Upload Path Traversal | MEDIUM | 6.6 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18816 |
Baserow 2FA Verify Endpoint views.py verify improper authentication | LOW | 2.3 | — | — | VulDB | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-45100 |
OpenSIPS: Buffer Overflow in Base64 Encode Transformation | CRITICAL | 9.1 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70592 |
Ghost: Database Backup Path Traversal | MEDIUM | 5.5 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-70591 |
Ghost: Server-Side Request Forgery in Image Fetching | MEDIUM | 4.1 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-70590 |
Ghost: Blind Password Hash Disclosure in Ghost Admin API | MEDIUM | 4.8 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-45084 |
OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state | HIGH | 8.7 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70619 |
Odysseus Missing Admin Authorization via Embedding Endpoint Routes | HIGH | 8.7 | — | — | VulnCheck | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70620 |
Odysseus SSRF via Embedding Endpoint Configuration | MEDIUM | 6.1 | — | — | VulnCheck | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18814 |
H3C NX15 esps reload.reload_config command injection | HIGH | 8.6 | — | — | VulDB | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70589 |
Ghost: Archived Offers can be Redeemed | MEDIUM | 4.8 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-70588 |
Ghost: Cross-Site Scripting in Universal Import | MEDIUM | 5.0 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18813 |
H3C NX15 esps delete command injection | HIGH | 8.6 | — | — | VulDB | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70494 |
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder | HIGH | 8.1 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70493 |
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically | MEDIUM | 6.5 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-13227 |
ERPNext v16.25.0 - Improper authorization in Prospect opportunities API | HIGH | 7.1 | — | — | Fluid Attacks | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70492 |
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages | HIGH | 8.7 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70491 |
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints | MEDIUM | 6.5 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-66902 |
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated sy… | — | — | — | — | CPANSec | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-66901 |
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated… | — | — | — | — | CPANSec | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-45538 |
OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy | CRITICAL | 9.8 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70490 |
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check | MEDIUM | 6.3 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-70489 |
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing | MEDIUM | 6.5 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-54020 |
Open WebUI: DNS Rebinding SSRF Bypass | MEDIUM | 6.3 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-70488 |
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup | MEDIUM | 4.3 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18812 |
H3C NX15 esps esps.ipv6.wan command injection | HIGH | 8.6 | — | — | VulDB | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70487 |
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata | MEDIUM | 5.3 | — | — | GitHub_M | 2026-08-04 | — | — | raw · ⬇ |
CVE-2026-18811 |
H3C NX15 esps add command injection | HIGH | 8.6 | — | — | VulDB | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-65986 |
CVAT has stored XSS via annotation guide assets | HIGH | 8.5 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70554 |
MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie | CRITICAL | 9.3 | — | — | VulnCheck | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-70486 |
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin | HIGH | 8.2 | — | — | GitHub_M | 2026-08-04 | — | ⚠ Threat | raw · ⬇ |