Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 408,964
- Last 24h
- 1,942
- Critical, 7 days
- 354
- Known exploited
- 1,779
107,885 results · Clear filters · Feed
-
Medium 4.5
Malicious client could set xattr value outside of BuildKit state directory
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. name…
-
Medium 6.7
Possible panic from Git source resolver
In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.…
-
Medium 5.6
Bake filesystem path entitlements approval can be skipped in some multi-target builds
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some …
-
Medium 6.9
CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)
All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.
-
Medium 6.3
Umami 2FA Policy route.ts single-factor authentication
A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate …
-
Medium 5.4
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin…
-
Medium 5.0
IrfanView TIFF Wang Annotation heap-based overflow
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to b…
-
Medium 5.1
Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URL…
-
Medium 6.8
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page…
-
Medium 4.2
Silverstripe MFA: Can bypass MFA during password reset flow
Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is c…
-
Medium 6.3
EasySoft ZenTao PMS User model.php checkGroupChange privileges management
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege managemen…
-
Medium 4.4
Terragrunt catalog predictable temp symlink clobber
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary …
-
Medium 5.4
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging socia…
-
Medium 6.5
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social e…
-
Medium 5.1
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engi…
-
Medium 6.5
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social …
-
Medium 5.7
Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read m…
-
Medium 4.3
Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isol…
-
Medium 6.5
Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive in…
-
Medium 6.5
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soc…
-
Medium 4.3
Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolati…
-
Medium 5.4
UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker l…
-
Medium 5.4
UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging …
-
Medium 4.3
Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass sys…
-
Medium 5.9
UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social e…
-
Medium 4.3
Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acc…
-
Medium 5.3
Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive i…
-
Medium 5.4
UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements…
-
Medium 4.3
Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social …
-
Medium 5.4
UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social en…
-
Medium 5.4
UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveragi…
-
Medium 6.5
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social e…
-
Medium 5.4
Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI eleme…
-
Medium 6.5
Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin…
-
Medium 6.5
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acces…
-
Medium 4.3
Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acces…
-
Medium 5.4
UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social en…
-
Medium 6.5
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive informa…
-
Medium 5.3
Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…
-
Medium 4.3
UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social …