Browse All CVEs
13,605 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-96640 |
high | 8.2 | 0.0060 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree | |
CVE-2026-96642 |
high | 7.1 | 0.0034 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarI | |
CVE-2026-96643 |
high | 7.1 | 0.0037 | 2026-10-29 | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image | |
CVE-2026-96644 |
high | 7.1 | 0.0038 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py | |
CVE-2026-96778 |
high | 7.7 | 0.0045 | 2026-10-29 | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/li | |
CVE-2026-112921 |
high | 7.3 | 0.0036 | 2026-10-29 | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter rob | |
CVE-2026-103090 |
high | 8.8 | 0.0050 | 2026-10-29 | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Creden | |
CVE-2026-76288 |
high | 7.5 | 0.0047 | 2026-10-29 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticate | |
CVE-2026-76290 |
high | 7.5 | 0.0050 | 2026-10-29 | In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user c | |
CVE-2026-76291 |
high | 8.8 | 0.0039 | 2026-10-29 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds | |
CVE-2026-76293 |
high | 7.2 | 0.0047 | 2026-10-29 | In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds | |
CVE-2026-76298 |
high | 8.8 | 0.0035 | 2026-10-29 | In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin | |
CVE-2026-76300 |
high | 8.8 | 0.0035 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has | |
CVE-2026-76306 |
high | 7.5 | 0.0022 | 2026-10-29 | In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query f | |
CVE-2026-76307 |
high | 7.2 | 0.0040 | 2026-10-29 | In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles vie | |
CVE-2026-76526 |
high | 8.8 | 0.0036 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has | |
CVE-2026-76530 |
high | 8.8 | 0.0029 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has | |
CVE-2026-112212 |
high | 7.5 | 0.0019 | 2026-10-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19. | |
CVE-2026-15723 |
high | 8.2 | 0.0043 | 2026-10-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19. | |
CVE-2026-16255 |
high | 7.1 | 0.0022 | 2026-10-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6 | |
CVE-2026-114633 |
high | 7.0 | 0.0044 | 2026-10-29 | WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows de | |
CVE-2026-114635 |
high | 7.0 | 0.0019 | 2026-10-29 | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its | |
CVE-2026-114636 |
high | 7.0 | 0.0024 | 2026-10-29 | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress | |
CVE-2026-114637 |
high | 7.0 | 0.0028 | 2026-10-29 | Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the | |
CVE-2026-114638 |
high | 7.0 | 0.0022 | 2026-10-29 | Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kub | |
CVE-2026-114639 |
high | 7.0 | 0.0029 | 2026-10-29 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass be | |
CVE-2026-114640 |
high | 7.0 | 0.0019 | 2026-10-29 | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its | |
CVE-2026-114642 |
high | 7.0 | 0.0019 | 2026-10-29 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend rou | |
CVE-2026-114658 |
high | 8.7 | 0.0026 | 2026-10-29 | Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability | |
CVE-2026-114659 |
high | 7.1 | 0.0063 | 2026-10-29 | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its | |
CVE-2026-114660 |
high | 7.0 | 0.0021 | 2026-10-29 | Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDire | |
CVE-2026-114662 |
high | 8.6 | 0.0017 | 2026-10-29 | Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow t | |
CVE-2026-114663 |
high | 8.6 | 0.0018 | 2026-10-29 | Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default argumen | |
CVE-2026-114664 |
high | 7.1 | 0.0020 | 2026-10-29 | Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe | |
CVE-2026-114716 |
high | 8.5 | 0.0044 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header inject | |
CVE-2026-114720 |
high | 7.1 | 0.0079 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command inje | |
CVE-2026-114724 |
high | 8.1 | 0.0041 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primit | |
CVE-2026-114727 |
high | 8.3 | 0.0033 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content i | |
CVE-2026-96365 |
high | 7.5 | 0.0041 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allow | |
CVE-2026-110353 |
high | 7.5 | 0.0074 | 2026-10-29 | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of ser | |
CVE-2026-110354 |
high | 7.5 | 0.0081 | 2026-10-29 | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of servi | |
CVE-2026-114730 |
high | 7.2 | 0.0037 | 2026-10-29 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side | |
CVE-2026-109927 |
high | 7.2 | 0.0040 | 2026-10-29 | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when han | |
CVE-2026-109987 |
high | 7.2 | 0.0024 | 2026-10-29 | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin befo | |
CVE-2026-111958 |
high | 7.5 | 0.0025 | 2026-10-29 | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the si | |
CVE-2026-97328 |
high | 7.5 | 0.0028 | 2026-10-29 | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled H | |
CVE-2026-105270 |
high | 8.7 | 0.0053 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dro | |
CVE-2026-114177 |
high | 8.8 | 0.0018 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-element | |
CVE-2026-111830 |
high | 7.1 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-111851 |
high | 7.6 | 0.0027 | 2026-10-29 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnera |