Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
83,150 matching · page 81/1663Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-116680(opens NVD record) | Medium | 6.4 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0. | Oct 27, 2026 |
| CVE-2026-116679(opens NVD record) | Medium | 5.4 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5. | Oct 27, 2026 |
| CVE-2026-116678(opens NVD record) | Medium | 5.8 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. This flaw bypasses the remediation for CVE-2026-47160, which covered decimal, hexadecimal, octal, and IPv4-mapped IPv6 host normalization, because the second-stage IP-literal favicon fetch does not invoke the custom DNS resolver. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses. The issue affects instances with internal icon downloading enabled and can expose internal responses that resemble supported images or reveal reachability through timing, status, and cache behavior. This issue is fixed in version 1.37.0. | Oct 27, 2026 |
| CVE-2026-116677(opens NVD record) | Unscored | — | OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2. | Oct 27, 2026 |
| CVE-2026-116676(opens NVD record) | High | 8.8 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1. | Oct 27, 2026 |
| CVE-2026-116662(opens NVD record) | High | 7.5 | Tanium addressed a compression bomb vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116660(opens NVD record) | Medium | 4.3 | Tanium addressed an improper access controls vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116659(opens NVD record) | Medium | 4.3 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116658(opens NVD record) | Medium | 6.5 | Tanium addressed a denial of service vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116657(opens NVD record) | Medium | 5.3 | Tanium addressed a denial of service vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116656(opens NVD record) | High | 7.5 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116649(opens NVD record) | High | 7.1 | Tanium addressed an improper output sanitization vulnerability in Enforce. | Oct 27, 2026 |
| CVE-2026-116647(opens NVD record) | High | 7.1 | Tanium addressed an improper output sanitization vulnerability in Comply. | Oct 27, 2026 |
| CVE-2026-111054(opens NVD record) | Unscored | — | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-112374. Reason: This candidate is a duplicate of CVE-2026-112374. Notes: All CVE users should reference CVE-2026-112374 instead of this candidate. | Oct 27, 2026 |
| CVE-2026-108333(opens NVD record) | Low | 2.5 | Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. | Oct 27, 2026 |
| CVE-2026-108332(opens NVD record) | Medium | 6.3 | Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. | Oct 27, 2026 |
| CVE-2026-108331(opens NVD record) | Low | 3.3 | Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. | Oct 27, 2026 |
| CVE-2026-108330(opens NVD record) | Low | 3.6 | Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. | Oct 27, 2026 |
| CVE-2026-108329(opens NVD record) | High | 8.8 | Tanium addressed an unauthorized code execution vulnerability in Threat Response. | Oct 27, 2026 |
| CVE-2026-108328(opens NVD record) | Medium | 4.2 | Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. | Oct 27, 2026 |
| CVE-2026-108326(opens NVD record) | Medium | 6.5 | Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. | Oct 27, 2026 |
| CVE-2026-108325(opens NVD record) | Medium | 6.6 | Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. | Oct 27, 2026 |
| CVE-2026-108316(opens NVD record) | Medium | 4.3 | Tanium addressed an information disclosure vulnerability in Tanium Server. | Oct 27, 2026 |
| CVE-2026-108313(opens NVD record) | Medium | 6.6 | Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. | Oct 27, 2026 |
| CVE-2026-108311(opens NVD record) | Low | 2.7 | Tanium addressed an insufficient logging vulnerability in Tanium Server. | Oct 27, 2026 |
| CVE-2026-108310(opens NVD record) | Medium | 5.3 | Tanium addressed a denial of service vulnerability in Tanium Server. | Oct 27, 2026 |
| CVE-2026-108309(opens NVD record) | Medium | 5.5 | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. | Oct 27, 2026 |
| CVE-2026-108308(opens NVD record) | Medium | 6.5 | Tanium addressed a SQL injection vulnerability in Patch. | Oct 27, 2026 |
| CVE-2026-108307(opens NVD record) | High | 7.8 | Tanium addressed a heap-based buffer overflow vulnerability in Index. | Oct 27, 2026 |
| CVE-2026-108306(opens NVD record) | High | 7.8 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | Oct 27, 2026 |
| CVE-2026-108305(opens NVD record) | High | 7.8 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | Oct 27, 2026 |
| CVE-2026-108304(opens NVD record) | High | 7.8 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | Oct 27, 2026 |
| CVE-2026-108303(opens NVD record) | High | 8.8 | Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. | Oct 27, 2026 |
| CVE-2026-108302(opens NVD record) | Medium | 4.3 | Tanium addressed an improper access controls vulnerability in Comply. | Oct 27, 2026 |
| CVE-2026-108301(opens NVD record) | Medium | 6.0 | Tanium addressed an improper access controls vulnerability in Comply. | Oct 27, 2026 |
| CVE-2026-102816(opens NVD record) | Unscored | — | An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or wireless service instability, and may cause the device to apply parameters intended for a different regulatory region. | Oct 27, 2026 |
| CVE-2026-102815(opens NVD record) | Unscored | — | An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device. | Oct 27, 2026 |
| CVE-2026-102814(opens NVD record) | Unscored | — | An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible. Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges. | Oct 27, 2026 |
| CVE-2026-102813(opens NVD record) | Unscored | — | An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions. | Oct 27, 2026 |
| CVE-2026-102812(opens NVD record) | Unscored | — | A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup. Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials. | Oct 27, 2026 |
| CVE-2026-87897(opens NVD record) | Medium | 4.6 | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard. | Oct 27, 2026 |
| CVE-2026-82986(opens NVD record) | Medium | 4.6 | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. | Oct 27, 2026 |
| CVE-2026-82984(opens NVD record) | Medium | 4.3 | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers. | Oct 27, 2026 |
| CVE-2026-82983(opens NVD record) | Low | 3.3 | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels. | Oct 27, 2026 |
| CVE-2026-77173(opens NVD record) | Medium | 4.3 | A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential. | Oct 27, 2026 |
| CVE-2026-77172(opens NVD record) | Medium | 5.3 | App passwords were allowed to bypass password confirmation on sensitive endpoints. | Oct 27, 2026 |
| CVE-2026-77171(opens NVD record) | Low | 3.5 | A public shared collective always allowed recipients of the link to create pages. | Oct 27, 2026 |
| CVE-2026-77167(opens NVD record) | High | 7.5 | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database. | Oct 27, 2026 |
| CVE-2026-67400(opens NVD record) | Low | 3.5 | A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. | Oct 27, 2026 |
| CVE-2026-57201(opens NVD record) | High | 7.5 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | Oct 27, 2026 |