cve.li

Recent

CVE-2026-4393CWE-352

Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030

Published 2026-03-26 by drupal

CVE-2026-4933CWE-863

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029

Published 2026-03-26 by drupal

CVE-2026-3573CWE-863

AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

Published 2026-03-26 by drupal

CVE-2026-0965CWE-73

Libssh: libssh: denial of service via improper configuration file handling

Published 2026-03-26 by redhat

CVE-2026-0967CWE-1333

Libssh: libssh: denial of service via inefficient regular expression processing

Published 2026-03-26 by redhat

CVE-2026-0968CWE-476

Libssh: libssh: denial of service due to malformed sftp message

Published 2026-03-26 by redhat

CVE-2026-0964CWE-22

Libssh: improper sanitation of paths received from scp servers

Published 2026-03-26 by redhat

CVE-2026-0966CWE-124

Libssh: buffer underflow in ssh_get_hexa() on invalid input

Published 2026-03-26 by redhat

CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API

Published 2026-03-26 by GRAFANA

CVE-2026-33375

Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

Published 2026-03-26 by GRAFANA

CVE-2026-33644CWE-918

Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs

Published 2026-03-26 by GitHub_M

CVE-2026-3532CWE-178

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

Published 2026-03-26 by drupal

CVE-2026-3531CWE-288

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

Published 2026-03-26 by drupal

CVE-2026-3530CWE-918

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

Published 2026-03-26 by drupal

CVE-2026-3529CWE-79

Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

Published 2026-03-26 by drupal

CVE-2026-3528CWE-79

Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

Published 2026-03-26 by drupal

CVE-2026-3527CWE-306

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

Published 2026-03-26 by drupal

CVE-2026-3526CWE-863

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021

Published 2026-03-26 by drupal

CVE-2026-3525CWE-863

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

Published 2026-03-26 by drupal

CVE-2026-2100CWE-824

P11-kit: p11-kit: null dereference via c_derivekey with specific null parameters

Published 2026-03-26 by redhat

CVE-2026-33537CWE-918

Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked

Published 2026-03-26 by GitHub_M

CVE-2026-2239CWE-170

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

Published 2026-03-26 by redhat

CVE-2026-2272CWE-190

Gimp: gimp: memory corruption due to integer overflow in ico file handling

Published 2026-03-26 by redhat

CVE-2026-2271CWE-190

Gimp: gimp: denial of service via crafted psp image file

Published 2026-03-26 by redhat

CVE-2026-33536CWE-787CWE-121

ImageMagick has an Out-of-bounds Write via InterpretImageFilename

Published 2026-03-26 by GitHub_M

CVE-2026-33535CWE-787

ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

Published 2026-03-26 by GitHub_M

CVE-2026-33532CWE-674

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Published 2026-03-26 by GitHub_M

CVE-2026-32287

Infinite loop in github.com/antchfx/xpath

Published 2026-03-26 by Go

CVE-2026-32286

Denial of service in github.com/jackc/pgproto3/v2

Published 2026-03-26 by Go

CVE-2026-32285

Denial of service in github.com/buger/jsonparser

Published 2026-03-26 by Go

CVE-2026-32284

Denial of service in github.com/shamaton/msgpack

Published 2026-03-26 by Go

CVE-2026-33531CWE-89

InvenTree has Path Traversal In Report Templates

Published 2026-03-26 by GitHub_M

CVE-2026-33530CWE-202

InvenTree Vulnerable to ORM Filter Injection

Published 2026-03-26 by GitHub_M

CVE-2026-33632CWE-862

ClearanceKit: opfilter policy bypass via exchangedata and clone operations

Published 2026-03-26 by GitHub_M

CVE-2026-2436CWE-825

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

Published 2026-03-26 by redhat

CVE-2026-33631CWE-862

ClearanceKit: opfilter policy bypass via non-open file operations

Published 2026-03-26 by GitHub_M

CVE-2021-4474CWE-552

Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access

Published 2026-03-26 by VulnCheck

CVE-2026-33529CWE-22

Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Published 2026-03-26 by GitHub_M

CVE-2026-33528CWE-22

GoDoxy has a Path Traversal Vulnerability in its File API

Published 2026-03-26 by GitHub_M

CVE-2026-33525CWE-79

Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting

Published 2026-03-26 by GitHub_M

CVE-2023-7338CWE-78

Ruckus Unleashed Authenticated RCE in Gateway Mode

Published 2026-03-26 by VulnCheck

CVE-2026-3121CWE-266

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Published 2026-03-26 by redhat

CVE-2026-3190CWE-280

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

Published 2026-03-26 by redhat

CVE-2026-33152CWE-307

Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication

Published 2026-03-26 by GitHub_M

CVE-2026-33153CWE-89

Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic

Published 2026-03-26 by GitHub_M

CVE-2026-33148CWE-74

URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key

Published 2026-03-26 by GitHub_M

CVE-2026-29055CWE-1230

Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII

Published 2026-03-26 by GitHub_M

CVE-2026-4923CWE-1333

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Published 2026-03-26 by openjs

CVE-2026-26213CWE-78

thingino-firmware api.cgi Unauthenticated Command Injection in Captive Portal

Published 2026-03-26 by VulnCheck

CVE-2026-4926CWE-400CWE-1333

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Published 2026-03-26 by openjs

CVE-2026-28503CWE-639

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Published 2026-03-26 by GitHub_M

CVE-2026-33149CWE-644

Tandoor Recipes Vulnerable to Host Header Injection

Published 2026-03-26 by GitHub_M

CVE-2026-33506CWE-87CWE-601

DOM-Based XSS in Ory Polis Login Page

Published 2026-03-26 by GitHub_M

CVE-2026-33491CWE-121CWE-787

Zen-C has Stack-Based Buffer Overflow in Identifier Mangling

Published 2026-03-26 by GitHub_M

CVE-2026-33505CWE-89

Ory Keto has a SQL injection via forged pagination tokens

Published 2026-03-26 by GitHub_M

CVE-2026-33504CWE-89

Ory Hydra has a SQL injection via forged pagination tokens

Published 2026-03-26 by GitHub_M

CVE-2026-33503CWE-89

Ory Kratos has a SQL injection via forged pagination tokens

Published 2026-03-26 by GitHub_M

CVE-2026-33496CWE-1289CWE-305

Ory Oathkeeper has an authentication bypass by cache key confusion

Published 2026-03-26 by GitHub_M

CVE-2026-32857CWE-918

Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation

Published 2026-03-26 by VulnCheck

CVE-2026-33495CWE-862

Ory Oathkeeper has an authentication bypass by usage of untrusted header

Published 2026-03-26 by GitHub_M

CVE-2026-33494CWE-23

Ory Oathkeeper has a path traversal authorization bypass

Published 2026-03-26 by GitHub_M

CVE-2026-33732CWE-706

srvx is vulnerable to middleware bypass via absolute URI in request line

Published 2026-03-26 by GitHub_M

CVE-2026-33490CWE-706

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Published 2026-03-26 by GitHub_M

CVE-2026-33487CWE-347CWE-682

goxmldsig has validateSignature Loop Variable Capture Signature Bypass

Published 2026-03-26 by GitHub_M

CVE-2026-33486CWE-918

Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

Published 2026-03-26 by GitHub_M

CVE-2026-33481CWE-460

Syft improper temporary file cleanup

Published 2026-03-26 by GitHub_M

CVE-2026-33477CWE-863

FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content

Published 2026-03-26 by GitHub_M

CVE-2026-33470CWE-862CWE-863

Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp

Published 2026-03-26 by GitHub_M

CVE-2026-33469CWE-863

Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw

Published 2026-03-26 by GitHub_M

CVE-2026-33468CWE-89

Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

Published 2026-03-26 by GitHub_M

Load more ↓