Browse All CVEs
3,388 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-81694 |
critical | 9.3 | 0.0025 | 2026-10-29 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from unt | |
CVE-2026-82854 |
critical | 9.3 | 0.0198 | 2026-10-29 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized en | |
CVE-2026-56379 |
critical | 9.2 | 0.0164 | 2026-10-29 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in th | |
CVE-2026-105215 |
critical | 9.3 | 0.0034 | 2026-10-29 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hoste | |
CVE-2026-105209 |
critical | 9.3 | 0.0022 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnera | |
CVE-2026-105207 |
critical | 9.3 | 0.0031 | 2026-10-29 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts a | |
CVE-2025-71392 |
critical | 9.4 | 0.0044 | 2026-10-29 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escap | |
CVE-2025-71334 |
critical | 9.3 | 0.0436 | 2026-10-29 | Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing valida | |
CVE-2025-25034 |
critical | 9.3 | 0.0496 | 2026-10-29 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, | |
CVE-2024-8517 |
critical | 9.8 | 0.9461 | 2026-10-29 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remo | |
CVE-2023-53982 |
critical | 9.3 | 0.0061 | 2026-10-29 | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module | |
CVE-2017-20251 |
critical | 9.3 | 0.0056 | 2026-10-29 | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerabili | |
CVE-2026-97229 |
critical | 10.0 | 0.1843 | 2026-10-29 | KEV 5 PoC | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19. |
CVE-2026-90531 |
critical | 9.6 | 0.0140 | 2026-10-29 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Ref | |
CVE-2026-90532 |
critical | 10.0 | 0.0083 | 2026-10-29 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that coul | |
CVE-2026-103093 |
critical | 9.4 | — | 2026-10-29 | ServiceNow has remediated a sandbox escape security issue that was identified in the Servi | |
CVE-2026-91221 |
critical | 10.0 | 0.0052 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91222 |
critical | 9.9 | 0.0045 | 2026-10-29 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid | |
CVE-2026-97406 |
critical | 9.1 | 0.0022 | 2026-10-29 | XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and | |
CVE-2026-91224 |
critical | 9.9 | 0.0033 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91225 |
critical | 9.1 | 0.0044 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap | |
CVE-2026-91230 |
critical | 9.3 | 0.0034 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91231 |
critical | 10.0 | 0.0052 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap | |
CVE-2026-91232 |
critical | 9.9 | 0.0045 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91216 |
critical | 10.0 | 0.0052 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-89010 |
critical | 9.3 | 0.0317 | 2026-10-29 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an una | |
CVE-2026-113399 |
critical | 9.8 | 0.0018 | 2026-10-29 | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefo | |
CVE-2026-118769 |
critical | 9.2 | — | 2026-10-29 | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function bot | |
CVE-2026-110685 |
critical | 9.1 | 0.0017 | 2026-10-29 | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged valu | |
CVE-2026-91218 |
critical | 9.6 | 0.0037 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-118762 |
critical | 9.3 | — | 2026-10-29 | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/w | |
CVE-2026-107058 |
critical | 9.8 | — | 2026-10-29 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and ex | |
CVE-2026-119128 |
critical | 9.1 | — | 2026-10-29 | ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V | |
CVE-2026-119145 |
critical | 9.4 | — | 2026-10-29 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability bec | |
CVE-2026-93903 |
critical | 9.4 | 0.0026 | 2026-10-29 | 1 PoC | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validati |
CVE-2026-112256 |
critical | 9.2 | — | 2026-10-29 | Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanc | |
CVE-2026-111732 |
critical | 9.3 | — | 2026-10-29 | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data le | |
CVE-2026-90863 |
critical | 9.1 | — | 2026-10-29 | Missing authorization in the administrative interface of Progress Software WS_FTP Server v | |
CVE-2026-90864 |
critical | 9.1 | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0 | |
CVE-2026-84295 |
critical | 10.0 | — | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and | |
CVE-2026-90868 |
critical | 9.9 | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to | |
CVE-2026-90865 |
critical | 9.0 | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to | |
CVE-2026-90866 |
critical | 9.1 | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0 | |
CVE-2026-64024 |
critical | 9.4 | 0.0031 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CP | |
CVE-2026-110186 |
critical | 9.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary c | |
CVE-2026-93680 |
critical | 9.8 | — | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security res |
CVE-2026-62018 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
CVE-2026-62131 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
CVE-2026-62016 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
CVE-2026-62017 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. |