CVE Watch408.844 no arquivo completo

Vulnerabilidades exploráveis hoje

17,404na visualização atual

Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.

No catálogo KEV1,768

Novos KEV · 24H0

Exploit Today ≥ 701,700

Distribuição · última janela

Crítica
5,643
Alta
21,930
Média
21,129
Baixa
2,126

Filtros

Janela

Severidade

Filtros

Vulnerabilidades1,321–1,360 · 17,404

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1217285.3 MÉD

17.9%

——5SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.3d CVE-2026-1217277.5 ALT

33.2%

——10Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.3d CVE-2026-1215826.5 MÉD

32.2%

——10A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.3d CVE-2026-1215814.3 MÉD

13.5%

——4A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.3d CVE-2026-1215657.4 ALT

5.5%

——2Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.2d CVE-2026-1215396.3 MÉD

11.2%

——3A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.3d CVE-2026-1215353.7 BAI

44.4%

——13A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.2d CVE-2026-121520—

3.3%

——1In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.3d CVE-2026-1207757.2 ALT

28.5%

——9Tanium addressed a heap-based buffer overflow vulnerability in Deploy.3d CVE-2026-118237—

19.1%

——6An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.3d CVE-2026-1166696.5 MÉD

16.2%

——5Tanium addressed an improper access controls vulnerability in Discover.1d CVE-2026-1166684.3 MÉD

18.0%

——5Tanium addressed an uncontrolled resource consumption vulnerability in Discover.1d CVE-2026-1166674.2 MÉD

3.8%

——1Tanium addressed an improper access controls vulnerability in Discover.1d CVE-2026-1166664.3 MÉD

11.9%

——4Tanium addressed an information disclosure vulnerability in Discover.1d CVE-2026-1166654.3 MÉD

11.9%

——4Tanium addressed an information disclosure vulnerability in Discover.1d CVE-2026-1166643.1 BAI

6.5%

——2Tanium addressed an improper access controls vulnerability in Discover.1d CVE-2026-1166636.5 MÉD

16.2%

——5Tanium addressed an improper access controls vulnerability in Enforce.3d CVE-2026-1166616.5 MÉD

11.6%

——3Tanium addressed an improper access controls vulnerability in Enforce.3d CVE-2026-1166546.5 MÉD

19.3%

——6Tanium addressed an improper input validation vulnerability in Threat Response.3d CVE-2026-1166534.3 MÉD

10.2%

——3Tanium addressed an improper input validation vulnerability in Threat Response.3d CVE-2026-1166524.3 MÉD

10.2%

——3Tanium addressed a business logic error in Threat Response.3d CVE-2026-1166517.5 ALT

27.9%

——8Tanium addressed an unauthorized code execution vulnerability in Threat Response.3d CVE-2026-1166507.5 ALT

27.9%

——8Tanium addressed an unauthorized code execution vulnerability in Threat Response.3d CVE-2026-1166484.1 MÉD

10.4%

——3Tanium addressed an improper output sanitization vulnerability in Discover.1d CVE-2026-1166464.3 MÉD

18.0%

——5Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.3d CVE-2026-111085—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2026-110288—

8.4%

——3A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.3d CVE-2026-1098366.7 MÉD

2.0%

——1The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written.3d CVE-2026-108516—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2026-1083275.0 MÉD

18.0%

——5Tanium addressed a path traversal vulnerability in Tanium Data Service.3d CVE-2026-1083246.5 MÉD

7.4%

——2Tanium addressed a denial of service vulnerability in Tanium Client.3d CVE-2026-107916—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2026-104608—

34.5%

——10A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.3d CVE-2026-103429—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2022-302677.5 ALT

23.7%

——7Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.3d CVE-2022-299669.8 CRÍ

33.7%

——10Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.3d CVE-2026-22060—

18.4%

——6All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.1d CVE-2026-22058—

10.9%

——3StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.1d CVE-2026-121614—

2.4%

——1Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.3d CVE-2026-121542—

3.8%

——1In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.2d