Browse CVEs

HIGH 7.3 CVE-2026-40144 A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to versi… No fix yet Fix from $4,9002026-08-17 HIGH 7.4 CVE-2025-27772 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnera… No fix yet Fix from $4,9002026-08-17 HIGH 7.4 CVE-2025-27771 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/add_prompts` endpoint is vul… No fix yet Fix from $4,9002026-08-17 HIGH 7.4 CVE-2025-27770 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is … No fix yet Fix from $4,9002026-08-17 HIGH 7.7 CVE-2025-27621 UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new … No fix yet Fix from $4,9002026-08-17 MEDIUM 6.1 CVE-2026-73851 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description co… Patch available Fix from $4,0002026-08-17 HIGH 7.7 CVE-2026-71567 In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into … No fix yet Fix from $4,9002026-08-17 CRITICAL 9.3 CVE-2026-71566 FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to valida… No fix yet Fix from $5,7502026-08-17 MEDIUM 6.3 CVE-2026-16048 Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles w… Mattermost Server 10.11.22 / 11.7.7+ Fix from $4,0002026-08-17 MEDIUM 5.4 CVE-2026-16044 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive impo… Mattermost Server 10.11.22 / 11.7.7+ Fix from $4,0002026-08-17 HIGH 7.3 CVE-2026-13202 A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2. No fix yet Fix from $4,9002026-08-17 MEDIUM 6.3 CVE-2026-10527 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which all… Mattermost Server 10.11.22 / 11.7.7+ Fix from $4,0002026-08-17 MEDIUM 5.5 CVE-2026-59911 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low pri… Objectscale 4.3.0.1+ Fix from $4,0002026-08-17 HIGH 7.8 CVE-2026-59910 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Objectscale 4.3.0.1+ Fix from $4,9002026-08-17 HIGH 7.1 CVE-2026-59909 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially… Objectscale 4.3.0.1+ Fix from $4,9002026-08-17 HIGH 7.8 CVE-2026-56686 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Objectscale 4.3.0.1+ Fix from $4,9002026-08-17 HIGH 7.3 CVE-2026-56685 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')… Objectscale 4.3.0.1+ Fix from $4,9002026-08-17 HIGH 7.3 CVE-2026-56090 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local acces… Objectscale 4.3.0.1+ Fix from $4,9002026-08-17 HIGH 8.1 CVE-2026-19693 extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an ar… No fix yet Fix from $4,9002026-08-17 HIGH 7.5 CVE-2026-16471 Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. Thi… No fix yet Fix from $4,9002026-08-17 HIGH 7.2 CVE-2026-16139 In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation i… No fix yet Fix from $4,9002026-08-17 HIGH 8.0 CVE-2026-16138 In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with wr… No fix yet Fix from $4,9002026-08-17 HIGH 7.2 CVE-2026-16137 In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable uplo… No fix yet Fix from $4,9002026-08-17 HIGH 7.9 CVE-2026-15218 A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide perm… No fix yet Fix from $4,9002026-08-17 MEDIUM 6.4 CVE-2026-75010 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to… Patch available Fix from $4,0002026-08-17 MEDIUM 5.4 CVE-2026-75007 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, whic… Patch available Fix from $4,0002026-08-17 MEDIUM 5.8 CVE-2026-75006 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to… Patch available Fix from $4,0002026-08-17 MEDIUM 5.8 CVE-2026-75003 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image bloc… Patch available Fix from $4,0002026-08-17 HIGH 7.1 CVE-2026-75002 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure… Patch available Fix from $4,9002026-08-17 MEDIUM 5.8 CVE-2026-75000 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image … No fix yet Fix from $4,0002026-08-17