CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
229687 CVEs matched. Showing 2351–2400 (page 48 of 4594).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-45381 |
Tautulli: Reflected XSS in `/search` endpoint | MEDIUM | 5.1 | — | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-49995 |
Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter | MEDIUM | 4.8 | — | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-54915 |
Tautulli: Open redirect via whitespace bypass in /auth/redirect | MEDIUM | 5.4 | 5.4 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-52835 |
Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database | HIGH | 7.0 | — | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-62247 |
Supabase Realtime: Incorrect Authorization | MEDIUM | 6.5 | 6.5 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-91167 |
Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssi… | MEDIUM | 6.0 | — | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-91166 |
Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target | MEDIUM | 5.7 | 5.7 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-91165 |
Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values | LOW | 2.4 | 2.4 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-91164 |
Warpgate: API tokens bypass the user's allowed_ip_ranges restriction | MEDIUM | 4.3 | 4.3 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-63330 |
Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on T… | HIGH | 7.7 | 7.7 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-63329 |
Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Ta… | MEDIUM | 4.9 | 4.9 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-58491 |
Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter | CRITICAL | 9.3 | 9.3 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-61748 |
InvenTree: Report/Label print endpoints ignore per-model permissions | MEDIUM | 4.3 | 4.3 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-61746 |
InvenTree: Plugin-settings GET endpoints are readable without authentication | MEDIUM | 5.3 | 5.3 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-61744 |
InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's vie… | MEDIUM | 6.5 | 6.5 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-61747 |
InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column m… | MEDIUM | 4.3 | 4.3 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-17052 |
Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from us… | HIGH | 7.8 | 7.8 | — | zephyr | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-61749 |
InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure | MEDIUM | 6.5 | 6.5 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-94403 |
ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference | CRITICAL | 9.3 | 8.8 | — | VulDB | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-82165 |
CVE-2026-82165 | MEDIUM | 5.5 | 5.5 | — | dell | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-49810 |
CVE-2026-49810 | HIGH | 7.8 | 7.8 | — | dell | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94501 |
jshERP through 3.6 Privilege Escalation via userBusiness CRUD | HIGH | 8.7 | 8.8 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94497 |
jshERP through 3.6 Unauthorized Access via by-id Endpoints | HIGH | 8.7 | 8.3 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94496 |
jshERP through 3.6 Privilege Escalation via Role Management | HIGH | 8.7 | 8.3 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94495 |
jshERP through 3.6 Missing Authorization via systemConfig | HIGH | 7.1 | 7.1 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94494 |
jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info | MEDIUM | 5.3 | 5.0 | — | VulnCheck | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-94414 |
jshERP through 3.6 Missing Authorization via updateBtnStr | MEDIUM | 5.3 | 5.4 | — | VulnCheck | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-94413 |
jshERP through 3.6 Password Hash Disclosure via /user/info | HIGH | 7.1 | 6.5 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94412 |
jshERP through 3.6 Authorization Bypass via resetPwd | HIGH | 8.7 | 8.8 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94411 |
jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType | HIGH | 8.7 | 8.8 | — | VulnCheck | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-82163 |
CVE-2026-82163 | MEDIUM | 5.5 | 5.5 | — | dell | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-66280 |
CVE-2026-66280 | — | — | — | — | Silabs | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-61745 |
InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equip… | MEDIUM | 4.3 | 4.3 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-69190 |
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards | MEDIUM | 6.3 | 6.3 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-55473 |
HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadat… | MEDIUM | 6.0 | — | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-48826 |
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching | HIGH | 8.1 | 8.1 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-48974 |
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler | MEDIUM | 5.4 | 5.4 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-48975 |
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintena… | HIGH | 8.1 | 8.1 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-48976 |
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack | HIGH | 8.1 | 8.1 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-62182 |
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes | HIGH | 8.8 | 8.8 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-61612 |
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 | MEDIUM | 5.7 | 5.7 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-94488 |
CVE-2026-94488 | HIGH | 8.3 | 8.2 | — | mitre | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-92382 |
Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write | MEDIUM | 4.1 | 4.1 | — | redhat | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-93012 |
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a… | — | — | — | — | CPANSec | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-62369 |
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join | HIGH | 8.1 | 8.1 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-62370 |
KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub | MEDIUM | 6.5 | 6.5 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |
CVE-2026-62371 |
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API | HIGH | 8.8 | 8.8 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-94449 |
Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of servic… | HIGH | 7.5 | 7.5 | — | redhat | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-63116 |
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes | HIGH | 8.8 | 8.8 | — | GitHub_M | 2026-09-21 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-59168 |
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS | MEDIUM | 6.2 | 6.2 | — | GitHub_M | 2026-09-21 | 10 | — | raw · ⬇ |