CWE-20
CVEs classified under CWE-20, newest first.
655 CVEsRSS
GHSA-c7hr-448w-65pxHigh· 8.3MeshCentral has unsanitized data fields
MeshCentral has unsanitized data fields
CVE-2026-63335MediumThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java proces…
CVE-2026-61634Low· 7.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/r…
CVE-2026-64780Medium· 4.3⚖ disputedThe issue was addressed with improved checks
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an …
CVE-2026-64781Medium· 4.3The issue was addressed with improved input validation
The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may l…
CVE-2026-65336Medium· 4.3⚖ disputedThis issue was addressed through improved state management
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content m…
CVE-2026-65337Medium· 4.3⚖ disputedThis issue was addressed through improved state management
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content m…
CVE-2026-65340Medium· 4.3⚖ disputedThis issue was addressed through improved state management
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content m…
GHSA-mpwr-8vm7-h73fMediumpackage pkcs12: Authentication bypass in Decode functions
package pkcs12: Authentication bypass in Decode functions
CVE-2026-61666High· 7.5websocket-driver is a WebSocket protocol handler with pluggable I/O
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing …
CVE-2026-73845Medium· 5.3CKAN MCP Server is a tool for querying CKAN open data portals
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a pre…
CVE-2026-19730Medium· 4.2PoCThe 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC
The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL defau…
CVE-2026-49827Critical· 9.8WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote …
CVE-2026-73658High· 8.2Trigger.dev is a platform for building and deploying fully managed AI agents and workflows
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign us…
CVE-2026-69106High· 8.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
CVE-2026-73418High· 7.5NextAuth.js provides authentication for Next.js
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it r…
CVE-2026-27765Medium· 5.5Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service
Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a …
CVE-2026-48056Critical· 10.0Streambert is a cross-platform Electron Desktop App to stream and download video content
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process t…
CVE-2026-70325Medium· 5.5Powerpoint Information Disclosure Vulnerability
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-70323Medium· 5.5Microsoft Office Information Disclosure Vulnerability
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-70322Medium· 5.5Powerpoint Information Disclosure Vulnerability
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-70320Medium· 5.5Powerpoint Information Disclosure Vulnerability
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-70319Medium· 5.5Microsoft Office Word Information Disclosure Vulnerability
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-70318Medium· 5.5Microsoft Excel Information Disclosure Vulnerability
Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-70316Medium· 5.5Powerpoint Information Disclosure Vulnerability
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-70314Medium· 5.5Microsoft Office Information Disclosure Vulnerability
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-70313High· 7.8Microsoft PowerPoint Remote Code Execution Vulnerability
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-70312Medium· 5.5Powerpoint Information Disclosure Vulnerability
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
CVE-2026-63520High· 8.1PoCMicrosoft SharePoint Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-65811High· 8.8Power BI Remote Code Execution Vulnerability
Improper input validation in Power BI allows an authorized attacker to execute code over a network.