Browse CVEs

CRITICAL 9.8 CVE-2026-21992 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager produc… Identity Manager Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.1 CVE-2026-32817 Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the curre… Admidio 5.0.7+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32771 The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces).… Monitoring 0.2.2+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32769 Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malici… Fullchain 0.1.1+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32767 SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextS… Siyuan 3.6.1+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-33289 SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP… Suitecrm 7.15.1 / 8.9.3+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32985 Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality t… Xerte Online Toolkits after 3.14.0 Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32760 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions … Filebrowser 2.62.0+ Fix from $2,3002026-03-20 CRITICAL 9.1 CVE-2026-22732 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will n… Spring Security 5.7.22 / 5.8.24+ Fix from $2,3002026-03-19 CRITICAL 9.3 CVE-2026-32754 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scr… Freescout 1.8.209+ Fix from $2,3002026-03-19 CRITICAL 9.0 CVE-2026-32751 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via inner… Siyuan 3.6.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-32194 Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execu… Bing Images No fix yet Fix from $2,3002026-03-19 CRITICAL 9.0 CVE-2026-32038 OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network… Openclaw 2026.2.24+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-30872 OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based B… Openwrt 24.10.6 / 25.12.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-30871 OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based B… Openwrt 24.10.6 / 25.12.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-4395 Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-cont… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-3849 Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) suppor… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-3549 Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.1 CVE-2026-32749 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploa… Siyuan 3.6.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-32191 Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker t… Bing Images Mitigation only Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-32169 Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network. Azure Cloud Shell Mitigation only Fix from $2,3002026-03-19 CRITICAL 9.6 CVE-2026-30924 qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins whi… Qui 1.15.0+ Fix from $2,3002026-03-19 CRITICAL 10.0 CVE-2026-30836 Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard ag… Step Ca 0.30.0+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-27953 ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing … Ormar 0.23.1+ Fix from $2,3002026-03-19 CRITICAL 10.0 CVE-2026-26138 Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. Purview Mitigation only Fix from $2,3002026-03-19 CRITICAL 9.9 CVE-2026-26137 Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network. 365 Copilot Chat No fix yet Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-23658 Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. Azure Devops No fix yet Fix from $2,3002026-03-19 CRITICAL 9.1 CVE-2026-32238 OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command … Openemr 8.0.0.2+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-3548 Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when imprope… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-30694 An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component Dedecms after 5.7.118 Fix from $2,3002026-03-19