58.899 CVE seguite
800 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
CVE Tracker
58.899 CVE
Dieci fornitori seguiti per identificativo CPE, non per parola chiave: una CVE compare qui quando NVD dichiara quali prodotti tocca, di solito qualche giorno dopo la pubblicazione.
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordinato dal più alto |
|---|---|---|---|---|
| CVE-2026-8505 | CRIT 9.8 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuratio | 0,7% | — |
| CVE-2026-84939 | CRIT 9.1 | apache freemarker Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue a | 0,9% | — |
| CVE-2026-84842 | HIGH 8.1 | ibm guardium_data_protection IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact | 0,4% | — |
| CVE-2026-8481 | CRIT 9.9 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() | 0,9% | — |
| CVE-2026-8476 | CRIT 9.9 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, | 1,0% | — |
| CVE-2026-84637 | CRIT 9.8 | mozilla thunderbird Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear | 0,6% | — |
| CVE-2026-8451 | HIGH 7.5 | citrix netscaler_application_delivery_controller Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP | 0,5% | — |
| CVE-2026-84501 | MED 5.3 | apache zookeeper An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvi | 0,7% | — |
| CVE-2026-8447 | MED 6.1 | langflow langflow IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface. | 0,3% | — |
| CVE-2026-84452 | ND | Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication | 1,6% | — |
| CVE-2026-84440 | HIGH 7.5 | ibm guardium_data_protection IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by t | 0,7% | — |
| CVE-2026-84439 | MED 5.3 | apache zookeeper When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the aud | 0,7% | — |
| CVE-2026-84436 | CRIT 9.1 | ibm guardium_data_protection IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges. | 0,7% | — |
| CVE-2026-84422 | HIGH 7.2 | ibm guardium_data_protection IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges. | 0,7% | — |
| CVE-2026-84412 | CRIT 10.0 | adobe campaign Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arb | 1,2% | — |
| CVE-2026-84351 | HIGH 8.3 | google chrome Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 0,4% | — |
| CVE-2026-84334 | HIGH 8.1 | google chrome Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) | 0,1% | — |
| CVE-2026-84329 | MED 5.3 | google chrome Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | 0,3% | — |
| CVE-2026-84290 | MED 5.1 | ibm guardium_data_protection IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception han | 0,1% | — |
| CVE-2026-84003 | HIGH 7.4 | microsoft azure\/msal-node Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network. | 0,6% | — |
| CVE-2026-84001 | HIGH 7.5 | microsoft windows_10_1607 Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network. | 1,2% | — |
| CVE-2026-84000 | HIGH 7.8 | microsoft windows_10_1607 Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. | 0,3% | — |
| CVE-2026-83999 | HIGH 7.0 | microsoft windows_11_24h2 Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally. | 0,3% | — |
| CVE-2026-83998 | HIGH 8.8 | microsoft windows_10_1607 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 0,8% | — |
| CVE-2026-83997 | HIGH 8.1 | microsoft windows_10_21h2 Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | 0,7% | — |