Browse All CVEs
11,719 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-16118 |
high | 7.1 | 0.0022 | 2026-10-29 | A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_ma | |
CVE-2026-89058 |
high | 7.4 | 0.0026 | 2026-10-29 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("* | |
CVE-2026-119286 |
high | 7.5 | — | 2026-10-29 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 unt | |
CVE-2026-45049 |
high | 8.3 | — | 2026-10-29 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cr | |
CVE-2026-119282 |
high | 7.3 | — | 2026-10-29 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 | |
CVE-2026-119283 |
high | 7.5 | — | 2026-10-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing | |
CVE-2026-61671 |
high | 8.1 | — | 2026-10-29 | WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched | |
CVE-2026-61654 |
high | 8.3 | — | 2026-10-29 | Lightdash is an open source business intelligence platform. In affected versions through 0 | |
CVE-2026-61719 |
high | 8.9 | — | 2026-10-29 | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site sc | |
CVE-2026-13303 |
high | 8.7 | — | 2026-10-29 | HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery | |
CVE-2026-61576 |
high | 8.3 | — | 2026-10-29 | Lightdash is an open source business intelligence platform. In affected versions through 0 | |
CVE-2026-119203 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter | |
CVE-2026-119207 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consum | |
CVE-2026-119325 |
high | 7.5 | — | 2026-10-29 | Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access contro | |
CVE-2026-119205 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter | |
CVE-2026-119206 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take e | |
CVE-2026-119204 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consum | |
CVE-2026-119209 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consum | |
CVE-2026-119208 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consum | |
CVE-2026-90932 |
high | 8.6 | 0.0082 | 2026-10-29 | 1 PoC | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the c |
CVE-2026-85170 |
high | 7.1 | 0.0040 | 2026-10-29 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) an | |
CVE-2026-85171 |
high | 7.1 | 0.0056 | 2026-10-29 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in th | |
CVE-2026-85168 |
high | 7.7 | 0.0083 | 2026-10-29 | 1 PoC | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerabi |
CVE-2026-85169 |
high | 8.7 | 0.0088 | 2026-10-29 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in t | |
CVE-2026-85166 |
high | 7.2 | 0.0036 | 2026-10-29 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the | |
CVE-2026-85165 |
high | 7.2 | 0.0057 | 2026-10-29 | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free i | |
CVE-2026-72831 |
high | 8.7 | 0.0056 | 2026-10-29 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect aut | |
CVE-2026-72825 |
high | 7.2 | 0.0035 | 2026-10-29 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in t | |
CVE-2026-72826 |
high | 8.7 | 0.0047 | 2026-10-29 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a ne | |
CVE-2026-58652 |
high | 7.7 | 0.0080 | 2026-10-29 | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a Lu | |
CVE-2026-58660 |
high | 7.2 | 0.0050 | 2026-10-29 | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used b | |
CVE-2026-55202 |
high | 8.8 | 0.0038 | 2026-10-29 | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host hea | |
CVE-2026-40037 |
high | 7.1 | 0.0031 | 2026-10-29 | OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuar | |
CVE-2026-32989 |
high | 8.6 | 0.0022 | 2026-10-29 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allo | |
CVE-2026-105210 |
high | 8.8 | 0.0024 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in | |
CVE-2026-105212 |
high | 8.7 | 0.0032 | 2026-10-29 | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the h | |
CVE-2026-105208 |
high | 8.7 | 0.0008 | 2026-10-29 | ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthent | |
CVE-2026-100834 |
high | 8.2 | 0.0032 | 2026-10-29 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions | |
CVE-2026-104085 |
high | 8.7 | 0.0199 | 2026-10-29 | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that | |
CVE-2026-100725 |
high | 8.3 | 0.0024 | 2026-10-29 | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 shi | |
CVE-2026-100709 |
high | 7.7 | 0.0029 | 2026-10-29 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_t | |
CVE-2025-71397 |
high | 7.1 | 0.0055 | 2026-10-29 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated us | |
CVE-2025-71395 |
high | 7.1 | 0.0045 | 2026-10-29 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::r | |
CVE-2025-71391 |
high | 7.1 | 0.0056 | 2026-10-29 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net mod | |
CVE-2025-34509 |
high | 7.5 | 0.5587 | 2026-10-29 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. | |
CVE-2025-34458 |
high | 8.7 | 0.0046 | 2026-10-29 | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, c | |
CVE-2025-34506 |
high | 8.6 | 0.0091 | 2026-10-29 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerabi | |
CVE-2025-34457 |
high | 8.7 | 0.0051 | 2026-10-29 | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, c | |
CVE-2025-34023 |
high | 8.5 | 0.0160 | 2026-10-29 | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. | |
CVE-2025-34108 |
high | 8.6 | 0.0149 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the login functionality of Disk Puls |