CVE-2026-32xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
942 records · Page 8 of 10
NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 2.2.4 in the id parameter of the endpoint `/index.php?route=/queries/user/`. The application reflects user-supplied input from the id parameter into the HTML response without proper sanitization or output encoding. An attacker can craft a malicious URL containing Jav
UpdatedVim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointe
Updated- CVE-2026-32248: Parse Server: Account takeover via operator injection in authentication data identifier 9.3 Critical
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the
Updated Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, thi
UpdatedTinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.
Updated- CVE-2026-32245: Tinyauth's OIDC authorization codes are not bound to client on token exchange 6.5 Medium
Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization code is the same client the code was issued to. A malicious OIDC client operator can exchange another client's authorization code using their own client credentials, obtaining tokens for users who never authorized their application. This violat
Updated Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. To work around this issue, restrict summary generation by tighten
UpdatedDiscourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview, pote
Updated- CVE-2026-32242: Parse Server OAuth2 adapter shares mutable state across providers via singleton instance 9.1 Critical
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent authentication requests for different OAuth2 providers, one provider's token validation may execute usi
Updated Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execut
UpdatedCap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
UpdatedCap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in 1.4.0.
UpdatedOpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.
UpdatedBackstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets ar
UpdatedBackstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The
UpdatedBackstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable to a redirect URI allowlist bypass. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass the al
Updated- CVE-2026-32234: Parse Server has a SQL injection via query field name when using PostgreSQL 5.1 Medium
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with PostgreSQL as the database. The field name in a $regex query operator is passed to PostgreSQL using unpara
Updated ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.
UpdatedZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_i
UpdatedUptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to
UpdatedIn JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
UpdatedUI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
UpdatedSQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
UpdatedUse after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-32223: Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability 6.8 Medium
Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
Updated Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
UpdatedImproper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
UpdatedDouble free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
UpdatedInsertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
UpdatedInsertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
Updated- CVE-2026-32216: Windows Redirected Drive Buffering System Denial of Service Vulnerability 5.5 Medium
Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally.
Updated Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
UpdatedImproper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
UpdatedImproper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
UpdatedImproper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
UpdatedMissing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.
UpdatedImproper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
UpdatedExternal control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
UpdatedStack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
UpdatedProtection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
UpdatedImproper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
UpdatedUse after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
UpdatedStack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
UpdatedImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.
UpdatedDeserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordServer-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.
UpdatedFiles or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.
Updated- CVE-2026-32184: Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability 7.8 High
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges locally.
Updated Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.
Updated- CVE-2026-32181: Connected User Experiences and Telemetry Service Denial of Service Vulnerability 5.5 Medium
Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.
Updated Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
UpdatedHeap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
UpdatedA tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a speciall
UpdatedImproper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.
UpdatedImproper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.
UpdatedUncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.
UpdatedInsufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
UpdatedDouble free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.
UpdatedServer-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.
UpdatedImproper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
UpdatedAcceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
UpdatedExposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.
Updated- CVE-2026-32150: Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability 7.0 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
Updated Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.
UpdatedInsufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned
UpdatedImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, fi
UpdatedImproper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended dependency directory, allowing attacker-controlled paths (via relative traversal such
UpdatedAllocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing. The multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota uncha
Updated- CVE-2026-32144: OCSP designated-responder authorization bypass via missing signature verification 7.6 High
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder cer
Updated