Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

ID	Title	Severity	Tags	Detected
CVE-2026-62959	Out-of-Bounds Read in CVE-2026-62959 (CVE-2026-62959) vulnerability in CVE-2026-62959 (CVE-2026-62959). Risk of unauthorized operations or information disclosure.		Cwe 125 Cwe 195	1 month ago
CVE-2026-55825	Path Traversal in contao/contao (CVE-2026-55825) path traversal in contao/contao (CVE-2026-55825). Risk of unauthorized operations or information disclosure. Exploitable via ``jobUuid``. Mitigation: upgrade to `5.7.7` or later.	Low	Cwe 22	1 month ago
CVE-2026-38711	Command Injection in CVE-2026-38711 (CVE-2026-38711) command injection in CVE-2026-38711 (CVE-2026-38711). Successful exploitation can lead to full system takeover.	Critical	Cwe 77	1 month ago
CVE-2026-53551	Vulnerability in github.com/free5gc/free5gc (CVE-2026-53551) vulnerability in github.com/free5gc/free5gc (CVE-2026-53551). Risk of unauthorized operations or information disclosure. Exploitable via `POST /nausf-auth/v1/ue-authentications`. Mitigation: upgrade to `4.2.2` or later.		Denial of Service Cwe 20	1 month ago
GHSA-3whf-vgf2-9w6g	Vulnerability in zaino-state (GHSA-3whf-vgf2-9w6g) vulnerability in zaino-state (GHSA-3whf-vgf2-9w6g). Risk of unauthorized operations or information disclosure. Exploitable via ``previous_block_hash``. Mitigation: upgrade to `0.4.1` or later.			1 month ago
CVE-2026-53599	Unrestricted File Upload in redaxo/source (CVE-2026-53599) vulnerability in redaxo/source (CVE-2026-53599). Successful exploitation can lead to full system takeover. Exploitable via ``shell.php.any.jpg``. Mitigation: upgrade to `5.21.1` or later.	High	PHP Cwe 434	1 month ago
CVE-2026-53510	Code Injection in savon (CVE-2026-53510) code injection in savon (CVE-2026-53510). Successful exploitation can lead to full system takeover. Exploitable via ``module_eval``. Mitigation: upgrade to `2.17.2` or later.	High	Ruby Cwe 94	1 month ago
CVE-2026-18420	Vulnerability in Amazon aws (CVE-2026-18420) vulnerability in Amazon aws (CVE-2026-18420). Successful exploitation can lead to full system takeover.	High	AWS Amazon Cloud Remote Code Execution +1	1 month ago
CVE-2026-57232	SSRF (Server-Side Request Forgery) in symfony (CVE-2026-57232) SSRF in symfony (CVE-2026-57232). Risk of unauthorized operations or information disclosure.	Low	PHP Symfony Server-Side Request Forgery Cwe 918	1 month ago
CVE-2026-55824	Information Disclosure in contao/contao (CVE-2026-55824) vulnerability in contao/contao (CVE-2026-55824). Risk of unauthorized operations or information disclosure. Exploitable via ``Cookie``. Mitigation: upgrade to `5.7.7` or later.	Low	Symfony Cwe 200	1 month ago
CVE-2026-25552	Vulnerability in nginx (CVE-2026-25552) vulnerability in nginx (CVE-2026-25552). Risk of unauthorized operations or information disclosure.	Low	nginx Cwe 348	1 month ago
CVE-2026-18481	Cross-Site Scripting (XSS) in Amazon aws (CVE-2026-18481) cross-site scripting in Amazon aws (CVE-2026-18481). Confidential information can be exposed externally.	High	Cross-Site Scripting Cwe 79 AWS Amazon +1	1 month ago
CVE-2026-18321	Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd	Medium	Cwe 120	1 month ago
CVE-2026-65841	Vulnerability in jodit (CVE-2026-65841) vulnerability in jodit (CVE-2026-65841). Risk of unauthorized operations or information disclosure. Exploitable via ``node.nodeName``. Mitigation: upgrade to `4.13.6` or later.		Cwe 80	1 month ago
CVE-2026-62324	Cross-Site Scripting (XSS) in jodit (CVE-2026-62324) cross-site scripting in jodit (CVE-2026-62324). Risk of unauthorized operations or information disclosure. Exploitable via ``sanitizeHTMLElement``. Mitigation: upgrade to `4.12.31` or later.	Medium	JavaScript Cwe 79 Cwe 83	1 month ago
CVE-2026-53502	Path Traversal in thumbor (CVE-2026-53502) path traversal in thumbor (CVE-2026-53502). Risk of unauthorized operations or information disclosure. Exploitable via ``imaging.py``. Mitigation: upgrade to `7.8.0` or later.		Cwe 22	1 month ago
CVE-2026-53505	Vulnerability in thumbor (CVE-2026-53505) vulnerability in thumbor (CVE-2026-53505). Risk of unauthorized operations or information disclosure. Exploitable via ``value``. Mitigation: upgrade to `7.8.0` or later.	High	Denial of Service Cwe 400	1 month ago
CVE-2026-53504	Vulnerability in thumbor (CVE-2026-53504) vulnerability in thumbor (CVE-2026-53504). Risk of unauthorized operations or information disclosure. Exploitable via ``convolution``. Mitigation: upgrade to `7.8.0` or later.	High	Cwe 400	1 month ago
CVE-2026-53503	Vulnerability in thumbor (CVE-2026-53503) vulnerability in thumbor (CVE-2026-53503). Risk of unauthorized operations or information disclosure. Exploitable via ``columns_count``. Mitigation: upgrade to `7.8.0` or later.	High	C Denial of Service Cwe 20 Cwe 369	1 month ago
CVE-2026-53501	Vulnerability in thumbor (CVE-2026-53501) vulnerability in thumbor (CVE-2026-53501). Data can be tampered with by attackers. Exploitable via ``url_to_validate``. Mitigation: upgrade to `7.8.0` or later.	High	Python Cwe 347	1 month ago
CVE-2026-53500	SSRF (Server-Side Request Forgery) in thumbor (CVE-2026-53500) SSRF in thumbor (CVE-2026-53500). Confidential information can be exposed externally. Exploitable via ``ALLOWED_SOURCES``. Mitigation: upgrade to `7.8.0` or later.	High	Cwe 918	1 month ago
CVE-2026-34490	Vulnerability in johnsoncontrols (CVE-2026-34490) vulnerability in johnsoncontrols (CVE-2026-34490). Confidential information can be exposed externally.	Medium	Cwe 312 Johnsoncontrols Xaap	1 month ago
CVE-2026-21662	Unrestricted File Upload in johnsoncontrols (CVE-2026-21662) vulnerability in johnsoncontrols (CVE-2026-21662). Successful exploitation can lead to full system takeover.	Critical	Cwe 434 Johnsoncontrols Fms Employee	1 month ago
CVE-2026-34497	Vulnerability in johnsoncontrols (CVE-2026-34497) vulnerability in johnsoncontrols (CVE-2026-34497). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Scripting Cwe 80 Johnsoncontrols Fms Employee	1 month ago
CVE-2026-34495	Cross-Site Scripting (XSS) in johnsoncontrols (CVE-2026-34495) cross-site scripting in johnsoncontrols (CVE-2026-34495). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Scripting Cwe 79 Johnsoncontrols Fms Employee	1 month ago
CVE-2026-54737	Vulnerability in @phun-ky/defaults-deep (CVE-2026-54737) vulnerability in @phun-ky/defaults-deep (CVE-2026-54737). Risk of unauthorized operations or information disclosure. Exploitable via ``__proto__``. Mitigation: upgrade to `2.0.5` or later.	High	Cwe 1321	1 month ago
CVE-2026-54725	SSRF (Server-Side Request Forgery) in github.com/bank-vaults/vault-secrets-webhook (CVE-2026-54725) SSRF in github.com/bank-vaults/vault-secrets-webhook (CVE-2026-54725). Confidential information can be exposed externally. Exploitable via ``VaultAddrAnnotation``. Mitigation: upgrade to `1.23.1` or later.	Critical	Cwe 918	1 month ago
CVE-2026-67822	Vulnerability in CVE-2026-67822 (CVE-2026-67822) vulnerability in CVE-2026-67822 (CVE-2026-67822). Successful exploitation can lead to full system takeover.	Critical	Cwe 121	1 month ago
CVE-2026-58048	SQL Injection in CVE-2026-58048 (CVE-2026-58048) SQL injection in CVE-2026-58048 (CVE-2026-58048). Risk of unauthorized operations or information disclosure.		Cwe 89	1 month ago
CVE-2026-58047	HTTP Smuggling in cPanel allows potential leak of credentials. HTTP Smuggling in cPanel allows potential leak of credentials.		Cwe 444	1 month ago
CVE-2026-55100	Vulnerability in hashi-vault-js (CVE-2026-55100) vulnerability in hashi-vault-js (CVE-2026-55100). Risk of unauthorized operations or information disclosure. Exploitable via ``encodeURIComponent``. Mitigation: upgrade to `0.5.2` or later.		JavaScript Path Traversal Cwe 23 Cwe 74	1 month ago
CVE-2026-54729	SSRF (Server-Side Request Forgery) in dssrf (CVE-2026-54729) SSRF in dssrf (CVE-2026-54729). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.0.5` or later.		JavaScript Server-Side Request Forgery Cwe 918	1 month ago
CVE-2026-12075	SSRF (Server-Side Request Forgery) in nltk (CVE-2026-12075) SSRF in nltk (CVE-2026-12075). Risk of unauthorized operations or information disclosure. Exploitable via ``nltk.pathsec``. Mitigation: upgrade to `3.10.0` or later.			1 month ago
CVE-2026-12061	Vulnerability in nltk (CVE-2026-12061) vulnerability in nltk (CVE-2026-12061). Risk of unauthorized operations or information disclosure. Exploitable via ``ReviewsCorpusReader``. Mitigation: upgrade to `3.10.0` or later.			1 month ago
CVE-2026-12072	Path Traversal in nltk (CVE-2026-12072) path traversal in nltk (CVE-2026-12072). Risk of unauthorized operations or information disclosure. Exploitable via ``NKJPCorpusReader``. Mitigation: upgrade to `3.10.0` or later.			1 month ago
CVE-2026-12074	Path Traversal in nltk (CVE-2026-12074) path traversal in nltk (CVE-2026-12074). Risk of unauthorized operations or information disclosure. Exploitable via ``nltk.pathsec``. Mitigation: upgrade to `3.10.0` or later.			1 month ago
CVE-2026-54706	Vulnerability in onionshare-cli (CVE-2026-54706) vulnerability in onionshare-cli (CVE-2026-54706). Confidential information can be exposed externally. Exploitable via ``onionshare_cli.web``. Mitigation: upgrade to `2.6.4` or later.	Medium	Cwe 59	1 month ago
CVE-2026-54707	Authorization Flaw in onionshare-cli (CVE-2026-54707) vulnerability in onionshare-cli (CVE-2026-54707). Risk of unauthorized operations or information disclosure. Exploitable via `POST /upload`. Mitigation: upgrade to `2.6.4` or later.	Medium	Cwe 863	1 month ago
CVE-2026-52856	Vulnerability in github.com/pterodactyl/wings (CVE-2026-52856) vulnerability in github.com/pterodactyl/wings (CVE-2026-52856). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.13.0` or later.	High	Cwe 129 Cwe 248 Cwe 617 Cwe 755	1 month ago
CVE-2026-67607	Vulnerability in c (CVE-2026-67607) vulnerability in c (CVE-2026-67607). Risk of unauthorized operations or information disclosure.	Medium	Cwe 367 C Denial of Service	1 month ago
CVE-2026-59232	Cross-Site Scripting (XSS) in CVE-2026-59232 (CVE-2026-59232) cross-site scripting in CVE-2026-59232 (CVE-2026-59232). Risk of unauthorized operations or information disclosure.		JavaScript Cross-Site Scripting Cwe 79	1 month ago
CVE-2026-59231	SSRF (Server-Side Request Forgery) in CVE-2026-59231 (CVE-2026-59231) SSRF in CVE-2026-59231 (CVE-2026-59231). Risk of unauthorized operations or information disclosure.		Cwe 918	1 month ago
CVE-2026-56571	Vulnerability in hcltech (CVE-2026-56571) vulnerability in hcltech (CVE-2026-56571). Risk of unauthorized operations or information disclosure.	Low	Cwe 209 Hcltech Icontrol	1 month ago
CVE-2026-56570	Vulnerability in hcltech (CVE-2026-56570) vulnerability in hcltech (CVE-2026-56570). Risk of unauthorized operations or information disclosure.	Low	Cwe 522 Hcltech Icontrol	1 month ago
CVE-2026-56569	Vulnerability in hcltech (CVE-2026-56569) vulnerability in hcltech (CVE-2026-56569). Risk of unauthorized operations or information disclosure.	Medium	Cwe 497 Hcltech Icontrol	1 month ago
CVE-2026-56568	Vulnerability in hcltech (CVE-2026-56568) vulnerability in hcltech (CVE-2026-56568). Risk of unauthorized operations or information disclosure.	Low	Cwe 209 Hcltech Icontrol	1 month ago
CVE-2026-56567	Vulnerability in hcltech (CVE-2026-56567) vulnerability in hcltech (CVE-2026-56567). Risk of unauthorized operations or information disclosure.	Medium	Cwe 15 Hcltech Icontrol	1 month ago
CVE-2026-18141	A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven... A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven...	High	Cwe 295 Ansible Authentication Bypass	1 month ago
CVE-2026-17566	OS Command Injection in pgadmin (CVE-2026-17566) OS command injection in pgadmin (CVE-2026-17566). Successful exploitation can lead to full system takeover. Exploitable via `POST /import_export/job/`.	Critical	Remote Code Execution Cwe 78 Cwe 115 Pgadmin +1	1 month ago
CVE-2026-17351	SQL Injection in pgadmin (CVE-2026-17351) SQL injection in pgadmin (CVE-2026-17351). Successful exploitation can lead to full system takeover.	Critical	Remote Code Execution Cwe 89 Cwe 115 Pgadmin +1	1 month ago

Vulnerabilities

🍪 About cookies