WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ode✕
Overview 3,720 matches · 281 in Waratek scope · 85 protected · 82 exploited · 35 CISA KEV · 273 public PoC · 115 EPSS ≥ 0.5
3,720matches 281in Waratek scope7.6% 85protected2.3% 82exploited2.2% 35CISA KEV0.9% 273public PoC7.3% 115EPSS ≥ 0.53.1%
Protected by Waratek 87 2.3% Rule in development 0 0.0% Mitigation candidate 5 0.1% No exploit published 189 5.1% Outside Waratek scope 259 7.0% Not applicable 3,180 85.5% Withdrawn CVE 0 0.0%
Critical 388 10.4% High 1,801 48.4% Medium 1,423 38.3% Low 108 2.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 85 2.3% partly blocked 2 0.1% not blocked 3,633 97.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 82 2.2% Working exploit published 179 4.8% Proof of concept only 348 9.4% Forecast only 23 0.6% No public exploit 3,088 83.0%
split by peak 512 / year
Not applicable: 3,180Outside Waratek scope: 259No exploit published: 189Mitigation candidate: 5Protected by Waratek: 87 Low: 108Medium: 1,423High: 1,801Critical: 388 not blocked: 3,633partly blocked: 2blocked by ARMR today: 85 No public exploit: 3,088Forecast only: 23Proof of concept only: 348Working exploit published: 179Exploited: 82
19991 Not applicable1 High1 not blocked1 Working exploit published1 20006 Not applicable6 High2 Medium3 Low1 not blocked6 Working exploit published1 No public exploit5 20017 Not applicable7 High5 Medium2 not blocked7 Working exploit published2 No public exploit5 200210 Not applicable10 High3 Medium6 Low1 not blocked10 Working exploit published3 No public exploit7 20036 Not applicable6 High3 Medium3 not blocked6 Working exploit published1 No public exploit5 200411 Outside Waratek scope2 Not applicable9 High3 Medium8 not blocked11 Working exploit published2 No public exploit9 200521 Not applicable21 Critical1 High11 Medium8 Low1 not blocked21 Exploited1 Working exploit published6 No public exploit14 200621 Not applicable21 High10 Medium11 not blocked21 Working exploit published9 No public exploit12 200746 No exploit published1 Outside Waratek scope1 Not applicable44 High25 Medium19 Low2 not blocked46 Working exploit published21 No public exploit25 200844 Not applicable44 High26 Medium17 Low1 not blocked44 Exploited1 Working exploit published22 No public exploit21 200952 Not applicable52 High43 Medium7 Low2 not blocked52 Working exploit published19 No public exploit33 201030 Not applicable30 High23 Medium6 Low1 not blocked30 Working exploit published14 No public exploit16 201131 Not applicable31 High19 Medium11 Low1 not blocked31 Working exploit published7 No public exploit24 201231 Not applicable31 High6 Medium22 Low3 not blocked31 Working exploit published1 No public exploit30 201336 No exploit published2 Outside Waratek scope2 Not applicable32 Critical2 High13 Medium21 not blocked36 Working exploit published1 No public exploit35 201474 Outside Waratek scope7 Not applicable67 High25 Medium45 Low4 not blocked74 Exploited1 Working exploit published6 No public exploit67 2015105 No exploit published2 Outside Waratek scope3 Not applicable100 Critical1 High36 Medium58 Low10 not blocked105 Exploited2 Working exploit published5 No public exploit98 2016103 Protected by Waratek1 No exploit published3 Outside Waratek scope5 Not applicable94 Critical15 High46 Medium36 Low6 blocked by ARMR today1 not blocked102 Exploited4 Working exploit published4 Proof of concept only1 Forecast only4 No public exploit90 2017124 Protected by Waratek5 No exploit published5 Outside Waratek scope5 Not applicable109 Critical24 High61 Medium37 Low2 blocked by ARMR today3 partly blocked2 not blocked119 Exploited4 Working exploit published11 Proof of concept only1 Forecast only1 No public exploit107 2018155 Protected by Waratek4 No exploit published15 Outside Waratek scope5 Not applicable131 Critical16 High86 Medium53 blocked by ARMR today4 not blocked151 Exploited1 Working exploit published8 No public exploit146 2019199 Protected by Waratek2 Mitigation candidate2 No exploit published12 Outside Waratek scope85 Not applicable98 Critical24 High93 Medium78 Low4 blocked by ARMR today2 not blocked197 Exploited11 Working exploit published5 Proof of concept only2 Forecast only6 No public exploit175 2020230 Protected by Waratek20 Mitigation candidate1 No exploit published10 Outside Waratek scope60 Not applicable139 Critical32 High97 Medium83 Low18 blocked by ARMR today20 not blocked210 Exploited7 Working exploit published6 Proof of concept only8 Forecast only1 No public exploit208 2021314 Protected by Waratek19 No exploit published11 Outside Waratek scope42 Not applicable242 Critical35 High142 Medium123 Low14 blocked by ARMR today19 not blocked295 Exploited18 Working exploit published6 Proof of concept only16 Forecast only7 No public exploit267 2022344 Protected by Waratek20 Mitigation candidate1 No exploit published30 Outside Waratek scope21 Not applicable272 Critical54 High126 Medium157 Low7 blocked by ARMR today20 not blocked324 Exploited6 Working exploit published4 Proof of concept only47 Forecast only4 No public exploit283 2023512 Protected by Waratek9 Mitigation candidate1 No exploit published26 Outside Waratek scope8 Not applicable468 Critical72 High259 Medium174 Low7 blocked by ARMR today9 not blocked503 Exploited9 Working exploit published8 Proof of concept only89 No public exploit406 2024487 No exploit published6 Outside Waratek scope6 Not applicable475 Critical53 High243 Medium189 Low2 not blocked487 Exploited5 Working exploit published2 Proof of concept only70 No public exploit410 2025359 Protected by Waratek3 No exploit published9 Outside Waratek scope6 Not applicable341 Critical25 High184 Medium144 Low6 blocked by ARMR today3 not blocked356 Exploited6 Working exploit published1 Proof of concept only62 No public exploit290 2026361 Protected by Waratek4 No exploit published57 Outside Waratek scope1 Not applicable299 Critical34 High210 Medium102 Low15 blocked by ARMR today4 not blocked357 Exploited6 Working exploit published3 Proof of concept only52 No public exploit300
1999200220052008201120142017202020232026
3,720 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 38 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-126405 High 2026-11-13 Not applicable No public exploit Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections.
CVE-2026-126404 High 2026-11-13 Not applicable No public exploit Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
CVE-2026-126403 High 2026-11-13 Not applicable No public exploit Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.
CVE-2026-126308 High 2026-11-13 Not applicable No public exploit The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-86949 High 2026-10-20 Not applicable No public exploit This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
CVE-2026-86948 High 2026-10-20 Not applicable No public exploit This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
CVE-2026-86875 Medium 2026-10-20 Not applicable No public exploit An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
CVE-2026-86874 Low 2026-10-20 Not applicable No public exploit An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.
CVE-2026-111793 Medium 2026-10-16 Not applicable Exploited Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
CVE-2026-110447 Critical 2026-10-14 Not applicable Exploited Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
CVE-2026-70098 High 2026-10-13 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-110206 High 2026-10-13 Not applicable No public exploit Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.
CVE-2026-110205 High 2026-10-13 Not applicable Proof of concept only Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled.
CVE-2026-110204 High 2026-10-13 Not applicable Proof of concept only Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.
CVE-2026-110203 High 2026-10-13 Not applicable No public exploit Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.
CVE-2026-110202 High 2026-10-13 Not applicable Proof of concept only Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine.
CVE-2026-102238 Critical 2026-10-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102235 High 2026-10-13 Not applicable No public exploit Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102234 High 2026-10-13 Not applicable No public exploit Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-102231 High 2026-10-13 Not applicable No public exploit Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-106558 High 2026-10-07 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.
CVE-2026-106556 High 2026-10-07 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-106510 High 2026-10-07 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-57554 High 2026-10-06 Not applicable No public exploit Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
CVE-2026-57545 High 2026-10-06 Not applicable No public exploit Memory corruption when processing draw objects of incorrect type during graphics command list execution.
CVE-2026-25302 High 2026-10-06 Not applicable No public exploit Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
CVE-2026-25291 High 2026-10-06 Not applicable No public exploit Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
CVE-2026-25270 Medium 2026-10-06 Not applicable No public exploit Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
CVE-2026-25267 High 2026-10-06 Not applicable No public exploit Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
CVE-2026-25263 Medium 2026-10-06 Not applicable No public exploit Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
CVE-2026-106509 High 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-106508 Medium 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4.
CVE-2026-106507 Medium 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4.
CVE-2026-106505 High 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-106460 Medium 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.
CVE-2026-106455 High 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.
CVE-2026-83963 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-83962 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-81998 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-79906 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-25275 High 2026-09-17 Not applicable No public exploit Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-24081 High 2026-09-17 Not applicable No public exploit Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
CVE-2026-88064 High 2026-09-16 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the documentation generator and cause unintended code execution. The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-54251 High 2026-09-15 No exploit published No public exploit netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.
CVE-2026-65393 Medium 2026-09-14 Not applicable No public exploit A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.
CVE-2026-84003 High 2026-09-08 Not applicable No public exploit Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-81383 High 2026-09-08 Not applicable No public exploit Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81381 High 2026-09-08 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81380 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81379 High 2026-09-08 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81378 High 2026-09-08 Not applicable No public exploit Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81377 Medium 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-81376 Critical 2026-09-08 Not applicable No public exploit Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81357 High 2026-09-08 Not applicable No public exploit Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81356 High 2026-09-08 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78462 High 2026-09-08 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78461 High 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70334 High 2026-09-08 Not applicable No public exploit Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-81161 Low 2026-09-02 Not applicable No public exploit Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.
CVE-2026-81838 Medium 2026-08-27 Not applicable No public exploit A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.
CVE-2026-54687 Medium 2026-08-27 Not applicable No public exploit n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
CVE-2026-12878 High 2026-08-25 Not applicable No public exploit In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
CVE-2026-76404 Critical 2026-08-19 Not applicable No public exploit In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
CVE-2026-59903 High 2026-08-17 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CVE-2026-73508 High 2026-08-13 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-73507 High 2026-08-13 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-70336 High 2026-08-11 Not applicable No public exploit Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-70335 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-69320 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-69306 High 2026-08-11 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69278 High 2026-08-11 Not applicable No public exploit Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-59113 High 2026-08-11 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-58650 High 2026-08-11 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47285 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-21400 Medium 2026-08-11 Not applicable No public exploit Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-56818 Medium 2026-08-07 No exploit published Proof of concept only Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-25292 High 2026-08-04 Not applicable No public exploit Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
CVE-2026-25289 Critical 2026-08-04 Not applicable No public exploit Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
CVE-2026-24084 High 2026-08-04 Not applicable No public exploit Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
CVE-2026-24079 High 2026-08-04 Not applicable No public exploit Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
CVE-2026-24078 Medium 2026-08-04 Not applicable No public exploit Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
CVE-2026-24077 Medium 2026-08-04 Not applicable No public exploit Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
CVE-2026-58043 High 2026-07-30 Not applicable No public exploit A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
CVE-2026-56850 Medium 2026-07-30 Not applicable No public exploit A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVE-2026-56847 Medium 2026-07-30 Not applicable No public exploit A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
CVE-2026-18245 Medium 2026-07-30 Not applicable No public exploit Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6
CVE-2026-10569 Medium 2026-07-30 Not applicable No public exploit IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an attacker with access to the logs to potentially obtain senstive values related to that step.
CVE-2026-59920 Medium 2026-07-29 No exploit published Proof of concept only Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in  CONNECT  and  CONNECTED  frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59919 Medium 2026-07-29 No exploit published Proof of concept only Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject  \r\n  sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59901 High 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59900 Medium 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59899 Medium 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59898 Medium 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-54082 Medium 2026-07-29 Protected by Waratek No public exploit veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.
CVE-2026-54079 High 2026-07-29 Protected by Waratek No public exploit veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.
CVE-2026-54078 High 2026-07-29 Protected by Waratek No public exploit veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.
CVE-2026-59921 Medium 2026-07-28 No exploit published Proof of concept only Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-55415 High 2026-07-28 Not applicable Proof of concept only datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.
CVE-2026-55391 High 2026-07-28 Not applicable Proof of concept only datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
‹ prev page 1 of 38 next ›