Recently updated CVEs

Nov 10, 2026 UTC

A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.

Nov 10, 2026 UTC

A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

Nov 10, 2026 UTC

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

Nov 10, 2026 UTC

A vulnerability that could allow an attacker to gain unauthorized access.

Nov 10, 2026 UTC

A vulnerability to perform a privilege escalation attack on the server as a non-admin user.

Nov 10, 2026 UTC

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

Nov 10, 2026 UTC

The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video funct…

Nov 10, 2026 UTC

Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.

Nov 10, 2026 UTC

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Nov 10, 2026 UTC

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Nov 10, 2026 UTC

The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.

Nov 10, 2026 UTC

The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account.

Nov 10, 2026 UTC

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.

Nov 10, 2026 UTC

A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account.

Nov 10, 2026 UTC

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command exe…