Full List

Search

Recent Vulnerabilities

• CVE-2026-70453 • published on August 13, 2026 rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.
• CVE-2026-70445 • published on August 5, 2026 Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
• CVE-2026-70441 • published on August 5, 2026 Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission.
• CVE-2026-70429 • published on August 5, 2026 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.
• CVE-2026-70428 • published on August 5, 2026 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.
• CVE-2026-70398 • published on August 12, 2026 A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.
• CVE-2026-70373 • published on August 4, 2026 Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
• CVE-2026-70371 • published on August 4, 2026 Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
• CVE-2026-70355 • published on August 11, 2026 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-70346 • published on August 11, 2026 Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
• CVE-2026-70340 • published on August 11, 2026 Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
• CVE-2026-70324 • published on August 11, 2026 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-70323 • published on August 11, 2026 Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-70322 • published on August 11, 2026 Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
• CVE-2026-70314 • published on August 11, 2026 Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-70312 • published on August 11, 2026 Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
• CVE-2026-70310 • published on August 11, 2026 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-6996 • published on April 25, 2026 A weakness has been identified in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This affects an unknown function of the component rmon event Tab. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
• CVE-2026-6990 • published on April 25, 2026 A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descrição results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
• CVE-2026-6953 • published on June 30, 2026 HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a victim via the contact form. To exploit this vulnerability, the attacker must send a request using the 'nombreApellidos', 'dirección ', and 'comentarios ' parameters to '/processContact.do'.