399973 matches found
CVE-2026-82994
...
CVE-2026-82995
...
CVE-2026-73965
...
CVE-2026-73966
...
CVE-2026-82992
...
CVE-2026-73961
...
CVE-2026-73963
...
CVE-2026-73962
...
CVE-2026-73960
...
CVE-2026-73959
...
CVE-2026-73958
...
CVE-2026-73956
...
CVE-2026-73955
...
CVE-2026-73957
...
CVE-2026-73954
...
CVE-2026-73953
...
CVE-2026-73950
...
CVE-2026-73952
...
CVE-2026-73951
...
CVE-2026-73949
...
CVE-2026-73948
...
CVE-2026-73946
...
CVE-2026-73945
...
CVE-2026-73947
...
CVE-2026-73944
...
CVE-2026-73942
...
CVE-2026-73943
...
CVE-2026-73941
...
CVE-2026-73940
...
CVE-2026-73926
...
CVE-2026-71133
...
CVE-2026-71047
...
CVE-2026-71163
...
CVE-2026-70915
...
CVE-2026-70913
...
CVE-2026-70757
...
CVE-2026-70756
...
CVE-2026-70755
...
CVE-2026-70748
...
CVE-2026-62597
...
CVE-2026-87287
...
CVE-2026-87288
...
CVE-2026-87286
...
CVE-2026-18425 IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...
CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...
CVE-2026-32599 Netmaker has a boolean‑based SQL Injection
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...
CVE-2026-61544 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after t...
CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...
CVE-2026-92240 Out-of-bounds read in IMAP response parser
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and...