CVE records
39888 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.
| CVE | Title | Published | Top score | KEV |
|---|---|---|---|---|
| CVE-2026-116323 | PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116322 | PostgreSQL pre-authentication cancel request can leak a spinlock | 12 Nov 2026 | 5.3 | |
| CVE-2026-116321 | PostgreSQL unterminated name value discloses server memory | 12 Nov 2026 | 4.3 | |
| CVE-2026-116320 | PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116319 | PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116318 | PostgreSQL pg_dump not-null constraint name allows SQL injection | 12 Nov 2026 | 8.8 | |
| CVE-2026-116317 | PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116316 | PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find | 12 Nov 2026 | 8.8 | |
| CVE-2026-116315 | PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116314 | PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation | 12 Nov 2026 | 8.8 | |
| CVE-2026-116313 | PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user | 12 Nov 2026 | 7.2 | |
| CVE-2026-116312 | PostgreSQL MERGE can place the wrong row in a trigger transition table | 12 Nov 2026 | 5.4 | |
| CVE-2026-116311 | PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables | 12 Nov 2026 | 5.4 | |
| CVE-2026-116310 | PostgreSQL COPY error context uses freed field storage | 12 Nov 2026 | 4.3 | |
| CVE-2026-116309 | PostgreSQL plperl blessed-reference type confusion may execute arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116308 | PostgreSQL dict_int reads beyond zero-length tokens | 12 Nov 2026 | 4.3 | |
| CVE-2026-116307 | PostgreSQL plperl prepared-query use-after-free executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116306 | PostgreSQL composite-type change during field assignment executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116304 | PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code | 12 Nov 2026 | 8.8 | |
| CVE-2026-116303 | PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions | 12 Nov 2026 | 3.1 | |
| CVE-2026-71367 | Awx: websocket broadcast groups leak cross-organization job metadata | 12 Nov 2026 | 4.3 | |
| CVE-2026-120869 | An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance | 12 Nov 2026 | 9.3 | |
| CVE-2026-123039 | Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket | 12 Nov 2026 | 7.8 | Exploited |
| CVE-2026-120490 | Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms | 12 Nov 2026 | 3.8 | |
| CVE-2026-107484 | Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user | 12 Nov 2026 | 7.3 | |
| CVE-2026-126995 | tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal | 12 Nov 2026 | 7.5 | |
| CVE-2026-92083 | Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer | 12 Nov 2026 | 7.8 | |
| CVE-2026-124018 | Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission | 12 Nov 2026 | 7.1 | |
| CVE-2026-124628 | 12 Nov 2026 | 8.7 | ||
| CVE-2026-124627 | 12 Nov 2026 | 8.7 | ||
| CVE-2026-116835 | 12 Nov 2026 | 8.7 | ||
| CVE-2026-114467 | Out-of-bounds Write in Git | 12 Nov 2026 | 3.3 | |
| CVE-2026-114466 | Insufficient Granularity of Access Control in Git | 12 Nov 2026 | 4.4 | |
| CVE-2026-114469 | Out-of-bounds Read in Git | 12 Nov 2026 | 4.4 | |
| CVE-2026-127058 | WonderCMS before 3.7.0 Unverified Password Change via saveAction | 12 Nov 2026 | 6.9 | |
| CVE-2026-97845 | Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt | 12 Nov 2026 | 4.3 | |
| CVE-2026-125285 | TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability | 12 Nov 2026 | 8.8 | |
| CVE-2026-125870 | BookStack before 26.09.3 Broken Access Control via ImageController | 12 Nov 2026 | 4.2 | |
| CVE-2026-75869 | Authenticated command injection | 12 Nov 2026 | 8.8 | |
| CVE-2026-127056 | PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan | 12 Nov 2026 | 8.7 | |
| CVE-2026-111552 | Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure | 12 Nov 2026 | 7.1 | |
| CVE-2026-75868 | Broken Access Control | 12 Nov 2026 | 8.1 | |
| CVE-2026-126994 | braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code | 12 Nov 2026 | 7.5 | |
| CVE-2026-110951 | Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure | 12 Nov 2026 | 7.5 | |
| CVE-2026-75867 | Broken Access Control | 12 Nov 2026 | 8.1 | |
| CVE-2026-127050 | Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback | 12 Nov 2026 | 7.1 | |
| CVE-2026-123139 | 12 Nov 2026 | 5.8 | ||
| CVE-2026-75864 | Broken Access Control | 12 Nov 2026 | 8.1 | |
| CVE-2026-19422 | Authentication Bypass | 12 Nov 2026 | 9.1 | |
| CVE-2026-126993 | SiteServer SSCMS captcha inadequate encryption | 12 Nov 2026 | 6.9 |