Watchlist

CVEs matching the watched terms (linux, openssh, openssl, amazon, aws, microsoft, apache, nginx, mysql, kubernetes, docker, redhat, ubuntu, debian), including medium severity. RSS feed

CVE-2026-96185 HIGH 7.5 Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a
CVE-2026-108456 HIGH 7.7 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges ove
CVE-2026-105014 CRITICAL 9.1 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows
CVE-2026-105933 LOW 2.3 Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace b
CVE-2026-105932 LOW 2.3 The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filte
CVE-2023-4050 HIGH 7.5 UPGRADE MITIGATE In some cases, an untrusted input stream was copied to a stack buffer without checking its size
CVE-2026-33267 CRITICAL 10.0 UPGRADE Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: f
CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
CVE-2026-74886 CRITICAL 9.8 UPGRADE openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuar
CVE-2026-74880 CRITICAL 9.8 UPGRADE openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry
CVE-2023-27536 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse p
CVE-2023-28321 MEDIUM 5.9 UPGRADE MITIGATE An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil
CVE-2026-41920 CRITICAL 9.3 UPGRADE Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fro
CVE-2023-23916 MEDIUM 6.5 UPGRADE MITIGATE An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch
CVE-2026-58153 HIGH 8.3 UPGRADE Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when co
CVE-2026-22068 HIGH 8.2 UPGRADE Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic
CVE-2026-54725 CRITICAL 9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible
CVE-2026-23904 HIGH 7.3 UPGRADE Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destina
CVE-2026-58177 HIGH 8.1 UPGRADE The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors
CVE-2026-66907 HIGH 7.5 UPGRADE Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache C
CVE-2026-48242 HIGH 8.1 Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, pass
CVE-2026-66908 HIGH 7.5 UPGRADE Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apac
CVE-2026-24033 HIGH 7.2 UPGRADE Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traff
CVE-2026-50622 HIGH 8.8 UPGRADE Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's ad
CVE-2026-62391 HIGH 8.1 UPGRADE The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuub
CVE-2026-66321 HIGH 7.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
CVE-2026-74892 HIGH 7.5 UPGRADE openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry serve
CVE-2026-65802 HIGH 7.4 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
CVE-2026-66312 MEDIUM 6.5 UPGRADE Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a netwo
CVE-2023-4049 MEDIUM 5.9 UPGRADE MITIGATE Race conditions in reference counting code were found through code inspection
CVE-2026-66315 HIGH 7.5 UPGRADE Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netwo
CVE-2026-44615 MEDIUM 6.5 UPGRADE Path traversal vulnerability in Apache Zeppelin
CVE-2026-66326 MEDIUM 6.5 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over
CVE-2023-37207 MEDIUM 6.5 UPGRADE UPGRADE A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external
CVE-2026-18481 HIGH 7.3 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an au
CVE-2026-66318 HIGH 8.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose informa
CVE-2026-66310 HIGH 7.7 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
CVE-2026-66314 MEDIUM 6.5 UPGRADE Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized at
CVE-2026-35167 HIGH 7.1 UPGRADE Kedro is a toolbox for production-ready data science
CVE-2026-64607 MEDIUM 5.3 UPGRADE HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con
CVE-2023-30549 HIGH 7.1 UPGRADE MITIGATE Apptainer is an open source container platform for Linux
CVE-2026-10079 HIGH 8.5 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
CVE-2026-17877 HIGH 8.4 UPGRADE Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local at
CVE-2026-65804 MEDIUM 6.1 UPGRADE Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unautho
CVE-2026-66311 MEDIUM 6.2 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering
CVE-2026-68813 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-66325 MEDIUM 6.1 UPGRADE Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfo
CVE-2024-47091 HIGH 7.8 DOWNGRADE Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL)
CVE-2026-66322 HIGH 7.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing
CVE-2026-70310 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-74632 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race P
CVE-2026-65325 MEDIUM 4.8 UPGRADE Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate co
CVE-2026-66313 MEDIUM 6.8 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tamperin
CVE-2026-66316 MEDIUM 5.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing
CVE-2026-66317 MEDIUM 5.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tamperin
CVE-2026-74890 MEDIUM 5.5 UPGRADE openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that di
CVE-2026-63239 MEDIUM 5.4 A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenan
CVE-2026-76376 MEDIUM 4.3 In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run act
CVE-2026-64565 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow
CVE-2026-74672 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge
CVE-2026-112381 MEDIUM 5.9 Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via ha
CVE-2026-111817 MEDIUM 5.3 Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.con
CVE-2026-111816 CRITICAL 9.3 Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, beca
CVE-2026-111810 HIGH 7.5 Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @
CVE-2026-111808 HIGH 8.6 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DA
CVE-2026-111805 HIGH 8.6 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-L
CVE-2026-111804 HIGH 8.2 Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and for
CVE-2026-105945 HIGH 7.7 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the brok
CVE-2026-105944 CRITICAL 10.0 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters
CVE-2026-105942 HIGH 7.7 When a configured proxy role sends a request to the broker on behalf of another user (the original principal),
CVE-2026-105938 LOW 2.3 Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription
CVE-2026-105937 HIGH 8.7 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that top
CVE-2026-105936 MEDIUM 5.3 The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors in
CVE-2026-105935 MEDIUM 4.9 The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-s
CVE-2026-105934 HIGH 7.2 The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/
CVE-2026-52680 CRITICAL 9.8 UPGRADE Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a
CVE-2026-66803 CRITICAL 10.0 MITIGATE Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
CVE-2026-28812 CRITICAL 9.8 UPGRADE UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to es
CVE-2026-66756 CRITICAL 9.8 DOWNGRADE Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.
CVE-2026-18245 CRITICAL 9.0 UPGRADE Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote
CVE-2025-61581 HIGH 7.5 UPGRADE ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Cont
CVE-2026-28811 HIGH 7.5 UPGRADE Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgr
CVE-2026-28814 HIGH 7.5 UPGRADE Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker t
CVE-2026-66755 HIGH 7.5 UPGRADE Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1
CVE-2026-44617 MEDIUM 6.5 UPGRADE LDAP filter injection vulnerability in Apache Zeppelin
CVE-2025-11573 HIGH 7.5 An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial
CVE-2026-18140 HIGH 7.5 UPGRADE Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which
CVE-2026-17894 HIGH 8.8 UPGRADE Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentia
CVE-2026-62246 HIGH 8.5 Kamaji is the Hosted Control Plane Manager for Kubernetes
CVE-2026-18378 HIGH 7.6 MITIGATE A flaw was found in koku-metrics-operator
CVE-2026-44616 MEDIUM 6.5 UPGRADE LDAP injection vulnerability in Apache Zeppelin
CVE-2026-18382 MEDIUM 6.8 MITIGATE A flaw was found in koku-metrics-operator
CVE-2026-23985 MEDIUM 6.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through
CVE-2026-28813 HIGH 8.8 UPGRADE Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are
CVE-2026-18381 HIGH 7.6 MITIGATE A flaw was found in the koku-metrics-operator for Red Hat OpenShift
CVE-2026-48910 MEDIUM 6.5 UPGRADE A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors
CVE-2026-65834 MEDIUM 6.8 Capsule is a multi-tenancy and policy-based framework for Kubernetes
CVE-2026-47873 HIGH 8.0 UPGRADE The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's n
CVE-2026-47882 HIGH 8.3 UPGRADE When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or
CVE-2026-44613 MEDIUM 6.1 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin
CVE-2026-65835 MEDIUM 6.6 Capsule is a multi-tenancy and policy-based framework for Kubernetes
CVE-2026-23981 MEDIUM 4.3 UPGRADE An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissi
CVE-2026-62845 MEDIUM 4.7 Kamaji is the Hosted Control Plane Manager for Kubernetes
CVE-2026-68563 MEDIUM 5.5 A flaw was found in ansible-collection-redhat-leapp
CVE-2026-17902 LOW 3.5 UPGRADE Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote atta
CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
CVE-2026-56162 CRITICAL 10.0 MITIGATE Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net
CVE-2026-71558 CRITICAL 9.8 UPGRADE Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ vers
CVE-2026-24254 CRITICAL 9.8 UPGRADE NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could c
CVE-2026-63508 CRITICAL 10.0 MITIGATE Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attack
CVE-2026-65667 CRITICAL 10.0 MITIGATE Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-61484 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue
CVE-2026-71289 CRITICAL 9.8 The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose
CVE-2026-68079 CRITICAL 9.8 UPGRADE In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited
CVE-2026-50515 CRITICAL 9.9 MITIGATE Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a ne
CVE-2026-62873 CRITICAL 9.8 MITIGATE Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker
CVE-2026-71560 CRITICAL 9.1 UPGRADE Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versi
CVE-2026-69096 HIGH 8.8 OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC bac
CVE-2026-68979 CRITICAL 9.8 UPGRADE Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce aut
CVE-2026-61486 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affect
CVE-2026-34191 CRITICAL 9.1 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache P
CVE-2026-61466 CRITICAL 9.1 UPGRADE In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `
CVE-2026-59115 CRITICAL 9.9 MITIGATE '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate priv
CVE-2026-50481 CRITICAL 9.9 MITIGATE Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to eleva
CVE-2026-62830 CRITICAL 9.9 MITIGATE Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
CVE-2026-60053 CRITICAL 9.1 UPGRADE Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0
CVE-2026-62836 HIGH 8.7 MITIGATE Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an un
CVE-2026-70332 CRITICAL 9.6 MITIGATE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
CVE-2026-68980 CRITICAL 9.1 UPGRADE Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Cont
CVE-2026-47623 HIGH 8.2 UPGRADE NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted da
CVE-2026-61483 HIGH 7.5 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apa
CVE-2026-71263 CRITICAL 9.1 The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/port
CVE-2026-32327 CRITICAL 9.1 UPGRADE A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer whi
CVE-2026-49163 HIGH 8.8 MITIGATE Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profile
CVE-2026-56161 CRITICAL 9.6 MITIGATE Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a netwo
CVE-2026-62896 CRITICAL 9.6 MITIGATE Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
CVE-2026-68823 CRITICAL 9.1 MITIGATE Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute cod
CVE-2026-24253 HIGH 8.2 UPGRADE NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write
CVE-2026-57817 HIGH 8.1 UPGRADE The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when opera
CVE-2026-59118 CRITICAL 9.3 MITIGATE Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-61372 HIGH 7.5 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fu
CVE-2026-68981 HIGH 7.5 UPGRADE Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jerse
CVE-2026-47612 HIGH 7.5 UPGRADE NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause im
CVE-2026-66257 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
CVE-2026-66273 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
CVE-2026-67465 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
CVE-2026-67551 HIGH 7.5 UPGRADE pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to p
CVE-2026-67588 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
CVE-2026-67589 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
CVE-2026-68060 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to