58.327 CVE seguite
790 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.327 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2026-28811 | HIGH 7.5 | apache jspwiki Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue. | 0,5% | — |
| CVE-2026-28779 | HIGH 7.5 | apache airflow Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tok | 0,7% | — |
| CVE-2026-28718 | HIGH 7.5 | acronis cyber_protect Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | 0,3% | — |
| CVE-2026-27651 | HIGH 7.5 | f5 nginx_open_source When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server p | 0,9% | — |
| CVE-2026-26171 | HIGH 7.5 | microsoft .net Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. | 1,8% | — |
| CVE-2026-26164 | HIGH 7.5 | microsoft 365_copilot_chat Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 0,8% | — |
| CVE-2026-26154 | HIGH 7.5 | microsoft windows_server_2012 Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. | 1,1% | — |
| CVE-2026-26144 | HIGH 7.5 | microsoft 365_apps Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 1,2% | — |
| CVE-2026-26130 | HIGH 7.5 | microsoft asp.net_core Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2,8% | — |
| CVE-2026-26129 | HIGH 7.5 | microsoft 365_copilot_chat Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 1,1% | — |
| CVE-2026-26127 | HIGH 7.5 | microsoft .net Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. | 2,0% | — |
| CVE-2026-26121 | HIGH 7.5 | microsoft azure_iot_explorer Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network. | 1,0% | — |
| CVE-2026-25667 | HIGH 7.5 | microsoft .net ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processin | 3,0% | — |
| CVE-2026-25181 | HIGH 7.5 | microsoft windows_10_1607 Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network. | 1,4% | — |
| CVE-2026-24880 | HIGH 7.5 | apache tomcat Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 throug | 0,5% | — |
| CVE-2026-24735 | HIGH 7.5 | apache answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unau | 0,6% | — |
| CVE-2026-24734 | HIGH 7.5 | apache tomcat Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al | 0,5% | — |
| CVE-2026-24308 | HIGH 7.5 | apache zookeeper Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level | 1,2% | — |
| CVE-2026-24264 | HIGH 7.5 | nvidia triton_inference_server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service. | 0,7% | — |
| CVE-2026-24255 | HIGH 7.5 | nvidia dynamo NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vuln | 0,4% | — |
| CVE-2026-24212 | HIGH 7.5 | nvidia isaac_launchable NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | 0,7% | — |
| CVE-2026-24210 | HIGH 7.5 | nvidia triton_inference_server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to denial of service. | 0,6% | — |
| CVE-2026-24209 | HIGH 7.5 | nvidia triton_inference_server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service. | 0,7% | — |
| CVE-2026-24012 | HIGH 7.5 | apache iotdb Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time ran | 0,7% | — |
| CVE-2026-23708 | HIGH 7.5 | fortinet fortisoar A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authe | 0,3% | — |