WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ode✕
Overview 3,084 matches · 228 in Waratek scope · 73 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
3,084matches 228in Waratek scope7.4% 73protected2.4% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 73 2.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 155 5.0% Outside Waratek scope 215 7.0% Not applicable 2,641 85.6% Withdrawn CVE 0 0.0%
Critical 299 9.7% High 1,515 49.1% Medium 1,174 38.1% Low 96 3.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 73 2.4% partly blocked 0 0.0% not blocked 3,011 97.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3,084 100.0%
split by peak 410 / year
Not applicable: 2,641Outside Waratek scope: 215No exploit published: 155Protected by Waratek: 73 Low: 96Medium: 1,174High: 1,515Critical: 299 not blocked: 3,011blocked by ARMR today: 73 No public exploit: 3,084
20005 Not applicable5 High2 Medium2 Low1 not blocked5 No public exploit5 20015 Not applicable5 High3 Medium2 not blocked5 No public exploit5 20027 Not applicable7 High1 Medium5 Low1 not blocked7 No public exploit7 20035 Not applicable5 High2 Medium3 not blocked5 No public exploit5 20049 Outside Waratek scope2 Not applicable7 High2 Medium7 not blocked9 No public exploit9 200514 Not applicable14 High7 Medium7 not blocked14 No public exploit14 200612 Not applicable12 High4 Medium8 not blocked12 No public exploit12 200725 No exploit published1 Outside Waratek scope1 Not applicable23 High10 Medium13 Low2 not blocked25 No public exploit25 200821 Not applicable21 High9 Medium11 Low1 not blocked21 No public exploit21 200933 Not applicable33 High27 Medium4 Low2 not blocked33 No public exploit33 201016 Not applicable16 High12 Medium3 Low1 not blocked16 No public exploit16 201124 Not applicable24 High13 Medium10 Low1 not blocked24 No public exploit24 201230 Not applicable30 High6 Medium21 Low3 not blocked30 No public exploit30 201335 No exploit published2 Outside Waratek scope2 Not applicable31 Critical2 High12 Medium21 not blocked35 No public exploit35 201467 Outside Waratek scope6 Not applicable61 High21 Medium42 Low4 not blocked67 No public exploit67 201598 No exploit published2 Outside Waratek scope2 Not applicable94 Critical1 High33 Medium55 Low9 not blocked98 No public exploit98 201690 Protected by Waratek1 No exploit published2 Outside Waratek scope3 Not applicable84 Critical14 High40 Medium31 Low5 blocked by ARMR today1 not blocked89 No public exploit90 2017107 Protected by Waratek2 No exploit published5 Outside Waratek scope5 Not applicable95 Critical18 High53 Medium34 Low2 blocked by ARMR today2 not blocked105 No public exploit107 2018146 Protected by Waratek4 No exploit published15 Outside Waratek scope3 Not applicable124 Critical12 High85 Medium49 blocked by ARMR today4 not blocked142 No public exploit146 2019175 Protected by Waratek2 No exploit published12 Outside Waratek scope73 Not applicable88 Critical19 High76 Medium76 Low4 blocked by ARMR today2 not blocked173 No public exploit175 2020208 Protected by Waratek19 No exploit published10 Outside Waratek scope57 Not applicable122 Critical25 High90 Medium76 Low17 blocked by ARMR today19 not blocked189 No public exploit208 2021267 Protected by Waratek14 No exploit published10 Outside Waratek scope32 Not applicable211 Critical30 High115 Medium109 Low13 blocked by ARMR today14 not blocked253 No public exploit267 2022283 Protected by Waratek17 No exploit published27 Outside Waratek scope13 Not applicable226 Critical41 High99 Medium137 Low6 blocked by ARMR today17 not blocked266 No public exploit283 2023406 Protected by Waratek8 No exploit published18 Outside Waratek scope7 Not applicable373 Critical54 High233 Medium112 Low7 blocked by ARMR today8 not blocked398 No public exploit406 2024410 No exploit published5 Outside Waratek scope4 Not applicable401 Critical43 High225 Medium140 Low2 not blocked410 No public exploit410 2025290 Protected by Waratek2 No exploit published7 Outside Waratek scope5 Not applicable276 Critical18 High160 Medium108 Low4 blocked by ARMR today2 not blocked288 No public exploit290 2026296 Protected by Waratek4 No exploit published39 Not applicable253 Critical22 High175 Medium88 Low11 blocked by ARMR today4 not blocked292 No public exploit296
200220052008201120142017202020232026
3,084 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 31 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-86949 High 2026-10-20 Not applicable No public exploit This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
CVE-2026-86948 High 2026-10-20 Not applicable No public exploit This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
CVE-2026-86875 Medium 2026-10-20 Not applicable No public exploit An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
CVE-2026-86874 Low 2026-10-20 Not applicable No public exploit An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.
CVE-2026-70098 High 2026-10-13 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-110206 High 2026-10-13 Not applicable No public exploit Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval.
CVE-2026-110203 High 2026-10-13 Not applicable No public exploit Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval.
CVE-2026-102238 Critical 2026-10-13 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102235 High 2026-10-13 Not applicable No public exploit Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102234 High 2026-10-13 Not applicable No public exploit Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-102231 High 2026-10-13 Not applicable No public exploit Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-106558 High 2026-10-07 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.
CVE-2026-106556 High 2026-10-07 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-106510 High 2026-10-07 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-57554 High 2026-10-06 Not applicable No public exploit Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
CVE-2026-57545 High 2026-10-06 Not applicable No public exploit Memory corruption when processing draw objects of incorrect type during graphics command list execution.
CVE-2026-25302 High 2026-10-06 Not applicable No public exploit Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
CVE-2026-25291 High 2026-10-06 Not applicable No public exploit Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
CVE-2026-25270 Medium 2026-10-06 Not applicable No public exploit Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
CVE-2026-25267 High 2026-10-06 Not applicable No public exploit Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
CVE-2026-25263 Medium 2026-10-06 Not applicable No public exploit Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
CVE-2026-106509 High 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-106508 Medium 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4.
CVE-2026-106507 Medium 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4.
CVE-2026-106505 High 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-106460 Medium 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.
CVE-2026-106455 High 2026-10-06 Not applicable No public exploit Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.
CVE-2026-83963 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-83962 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-81998 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-79906 High 2026-09-22 Not applicable No public exploit Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-25275 High 2026-09-17 Not applicable No public exploit Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-24081 High 2026-09-17 Not applicable No public exploit Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
CVE-2026-88064 High 2026-09-16 Not applicable No public exploit Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the documentation generator and cause unintended code execution. The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
CVE-2026-54251 High 2026-09-15 No exploit published No public exploit netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.
CVE-2026-65393 Medium 2026-09-14 Not applicable No public exploit A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.
CVE-2026-84003 High 2026-09-08 Not applicable No public exploit Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-81383 High 2026-09-08 Not applicable No public exploit Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81381 High 2026-09-08 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81380 Medium 2026-09-08 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81379 High 2026-09-08 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81378 High 2026-09-08 Not applicable No public exploit Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81377 Medium 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-81376 Critical 2026-09-08 Not applicable No public exploit Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81357 High 2026-09-08 Not applicable No public exploit Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81356 High 2026-09-08 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78462 High 2026-09-08 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-78461 High 2026-09-08 Not applicable No public exploit Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70334 High 2026-09-08 Not applicable No public exploit Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-81161 Low 2026-09-02 Not applicable No public exploit Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.
CVE-2026-81838 Medium 2026-08-27 Not applicable No public exploit A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.
CVE-2026-54687 Medium 2026-08-27 Not applicable No public exploit n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
CVE-2026-12878 High 2026-08-25 Not applicable No public exploit In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
CVE-2026-76404 Critical 2026-08-19 Not applicable No public exploit In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
CVE-2026-59903 High 2026-08-17 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CVE-2026-73508 High 2026-08-13 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-73507 High 2026-08-13 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-70336 High 2026-08-11 Not applicable No public exploit Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-70335 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-69320 High 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-69306 High 2026-08-11 Not applicable No public exploit Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69278 High 2026-08-11 Not applicable No public exploit Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-59113 High 2026-08-11 Not applicable No public exploit Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-58650 High 2026-08-11 Not applicable No public exploit Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47285 Medium 2026-08-11 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-21400 Medium 2026-08-11 Not applicable No public exploit Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-25292 High 2026-08-04 Not applicable No public exploit Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
CVE-2026-25289 Critical 2026-08-04 Not applicable No public exploit Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
CVE-2026-24084 High 2026-08-04 Not applicable No public exploit Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
CVE-2026-24079 High 2026-08-04 Not applicable No public exploit Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
CVE-2026-24078 Medium 2026-08-04 Not applicable No public exploit Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
CVE-2026-24077 Medium 2026-08-04 Not applicable No public exploit Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
CVE-2026-58043 High 2026-07-30 Not applicable No public exploit A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
CVE-2026-56850 Medium 2026-07-30 Not applicable No public exploit A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVE-2026-56847 Medium 2026-07-30 Not applicable No public exploit A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
CVE-2026-18245 Medium 2026-07-30 Not applicable No public exploit Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6
CVE-2026-10569 Medium 2026-07-30 Not applicable No public exploit IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an attacker with access to the logs to potentially obtain senstive values related to that step.
CVE-2026-59901 High 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59900 Medium 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59899 Medium 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-59898 Medium 2026-07-29 No exploit published No public exploit Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-54082 Medium 2026-07-29 Protected by Waratek No public exploit veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.
CVE-2026-54079 High 2026-07-29 Protected by Waratek No public exploit veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.
CVE-2026-54078 High 2026-07-29 Protected by Waratek No public exploit veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.
CVE-2026-54653 High 2026-07-28 Not applicable No public exploit datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits them into Field(default_factory=...) or field(default_factory=...), allowing Python expression execution when the generated model is imported. This issue is fixed in version 0.60.2.
CVE-2026-56817 High 2026-07-21 Protected by Waratek No public exploit Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-56816 High 2026-07-21 No exploit published No public exploit Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.
CVE-2026-56746 Medium 2026-07-21 No exploit published No public exploit Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-56745 High 2026-07-21 No exploit published No public exploit Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-55851 High 2026-07-21 No exploit published No public exploit Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-55833 High 2026-07-21 No exploit published No public exploit Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-57102 High 2026-07-14 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-57101 High 2026-07-14 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-50520 High 2026-07-14 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-48370 High 2026-07-14 Not applicable No public exploit Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-48366 High 2026-07-14 Not applicable No public exploit Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-47979 Medium 2026-07-14 Not applicable No public exploit Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-47976 High 2026-07-14 Not applicable No public exploit Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-47971 High 2026-07-14 Not applicable No public exploit Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-47282 Medium 2026-07-14 Not applicable No public exploit Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
‹ prev page 1 of 31 next ›