59.223 CVE seguite
803 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
59.223 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-94243 | HIGH 7.3 | apache sling_security A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue. | 0,2% | — |
| CVE-2026-93546 | HIGH 8.8 | apache http_server Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces. | 0,4% | — |
| CVE-2026-93381 | HIGH 8.8 | google chrome Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) | 0,4% | — |
| CVE-2026-93375 | HIGH 8.1 | google chrome Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | 0,1% | — |
| CVE-2026-9320 | MED 5.9 | ibm websphere_application_server IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to c | 0,6% | — |
| CVE-2026-92899 | MED 4.8 | apache wss4j Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An | 0,5% | — |
| CVE-2026-9262 | MED 6.5 | canon eos_network_setting_tool Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier | 0,5% | — |
| CVE-2026-9261 | MED 6.8 | canon eos_network_setting_tool Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier | 0,3% | — |
| CVE-2026-92609 | CRIT 9.8 | apache qpid_broker-j Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: | 0,4% | — |
| CVE-2026-92608 | HIGH 7.5 | apache qpid_broker-j Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issu | 0,5% | — |
| CVE-2026-9260 | MED 6.2 | canon eos_network_setting_tool Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier | 0,4% | — |
| CVE-2026-9259 | MED 6.5 | canon eos_network_setting_tool Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier | 0,3% | — |
| CVE-2026-9258 | MED 6.5 | canon eos_network_setting_tool Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier | 0,5% | — |
| CVE-2026-92573 | MED 6.5 | apache qpid_broker-j Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker a | 0,4% | — |
| CVE-2026-92564 | HIGH 7.5 | apache qpid_broker-j A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the iss | 0,5% | — |
| CVE-2026-92560 | HIGH 7.5 | apache qpid_broker-j A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fix | 0,5% | — |
| CVE-2026-9256 | HIGH 8.1 | debian debian_linux NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/( | 2,7% | — |
| CVE-2026-92550 | HIGH 7.5 | apache qpid_broker-j A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fix | 0,5% | — |
| CVE-2026-92415 | MED 5.3 | apache jackrabbit — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr | 0,3% | — |
| CVE-2026-92414 | CRIT 9.1 | apache jackrabbit : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. Thi | 0,6% | — |
| CVE-2026-92142 | HIGH 8.8 | apache karaf Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is i | 0,6% | — |
| CVE-2026-92121 | HIGH 7.5 | apache wss4j In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stop | 0,5% | — |
| CVE-2026-92001 | MED 6.1 | apache sling_xss_protection_api Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue. | 0,4% | — |
| CVE-2026-91999 | MED 6.1 | apache sling_xss_protection_api Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue. | 0,4% | — |
| CVE-2026-91928 | MED 6.1 | apache sling_xss_protection_api Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue. | 0,4% | — |