Browse All CVEs
10,582 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-17985 |
medium | 6.5 | 0.0030 | 2026-10-29 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed | |
CVE-2026-17986 |
medium | 6.5 | 0.0029 | 2026-10-29 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allow | |
CVE-2026-17988 |
medium | 6.5 | 0.0030 | 2026-10-29 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7 | |
CVE-2026-17992 |
medium | 6.5 | 0.0026 | 2026-10-29 | Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a rem | |
CVE-2026-17994 |
medium | 4.3 | 0.0024 | 2026-10-29 | Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 a | |
CVE-2026-17996 |
medium | 6.2 | 0.0013 | 2026-10-29 | Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 all | |
CVE-2026-17998 |
medium | 4.3 | 0.0019 | 2026-10-29 | Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an att | |
CVE-2026-17999 |
medium | 6.5 | 0.0023 | 2026-10-29 | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remo | |
CVE-2026-18001 |
medium | 6.5 | 0.0032 | 2026-10-29 | Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a re | |
CVE-2026-18003 |
medium | 4.3 | 0.0024 | 2026-10-29 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922 | |
CVE-2026-18004 |
medium | 4.3 | 0.0025 | 2026-10-29 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed | |
CVE-2026-18005 |
medium | 6.5 | 0.0032 | 2026-10-29 | Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a re | |
CVE-2026-18006 |
medium | 4.3 | 0.0015 | 2026-10-29 | Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowe | |
CVE-2026-18007 |
medium | 4.3 | 0.0024 | 2026-10-29 | Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 a | |
CVE-2026-18008 |
medium | 4.3 | 0.0023 | 2026-10-29 | Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a | |
CVE-2026-18009 |
medium | 4.3 | 0.0023 | 2026-10-29 | Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.79 | |
CVE-2026-18010 |
medium | 4.3 | 0.0023 | 2026-10-29 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed | |
CVE-2026-18013 |
medium | 4.3 | 0.0024 | 2026-10-29 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922 | |
CVE-2026-18014 |
medium | 6.5 | 0.0027 | 2026-10-29 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.792 | |
CVE-2026-18016 |
medium | 4.3 | 0.0020 | 2026-10-29 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7 | |
CVE-2026-18018 |
medium | 4.0 | 0.0012 | 2026-10-29 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 | |
CVE-2026-18019 |
medium | 4.3 | 0.0026 | 2026-10-29 | Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed | |
CVE-2026-59952 |
medium | 6.9 | 0.0038 | 2026-10-29 | Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError | |
CVE-2026-67246 |
medium | 6.9 | 0.0046 | 2026-10-29 | A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerabil | |
CVE-2026-56847 |
medium | 6.1 | 0.0016 | 2026-10-29 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable | |
CVE-2026-56850 |
medium | 4.4 | 0.0008 | 2026-10-29 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, | |
CVE-2026-58040 |
medium | 6.3 | 0.0028 | 2026-10-29 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips host | |
CVE-2026-59327 |
medium | 4.4 | 0.0010 | 2026-10-29 | Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.re | |
CVE-2026-59328 |
medium | 5.4 | 0.0017 | 2026-10-29 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a nativ | |
CVE-2026-64635 |
medium | 5.3 | 0.0029 | 2026-10-29 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Serv | |
CVE-2026-44097 |
medium | 5.3 | 0.0043 | 2026-10-29 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the | |
CVE-2026-16970 |
medium | 4.2 | 0.0022 | 2026-10-29 | The IRIS web application in version 2.4.26 and possibly others contains a logout functiona | |
CVE-2026-16971 |
medium | 5.9 | 0.0033 | 2026-10-29 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA va | |
CVE-2026-18362 |
medium | 5.9 | 0.0037 | 2026-10-29 | The IRIS web application in version 2.4.26 and possibly others does not protect its user a | |
CVE-2026-18378 |
medium | 6.8 | 0.0046 | 2026-10-29 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig cust | |
CVE-2026-18382 |
medium | 6.8 | 0.0052 | 2026-10-29 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig cust | |
CVE-2026-7260 |
medium | 5.4 | 0.0011 | 2026-10-29 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the | |
CVE-2026-54364 |
medium | 6.9 | 0.0043 | 2026-10-29 | CentreStack before 17.4 contains a session variable injection vulnerability that allows un | |
CVE-2026-11383 |
medium | 5.4 | 0.0023 | 2026-10-29 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server | |
CVE-2026-54885 |
medium | 6.9 | 0.0047 | 2026-10-29 | Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated re | |
CVE-2026-67347 |
medium | 6.1 | 0.0051 | 2026-10-29 | Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization byp | |
CVE-2026-15657 |
medium | 6.5 | 0.0034 | 2026-10-29 | A vulnerability in the foreUP customer REST API allows any authenticated user to read clea | |
CVE-2026-23981 |
medium | 5.3 | 0.0056 | 2026-10-29 | An Improper Authorization vulnerability exists in Apache Superset allowing an authenticate | |
CVE-2026-23985 |
medium | 5.3 | 0.0065 | 2026-10-29 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset ver | |
CVE-2026-44613 |
medium | 6.1 | 0.0039 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS confi | |
CVE-2026-44616 |
medium | 6.5 | 0.0076 | 2026-10-29 | LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDA | |
CVE-2026-44617 |
medium | 6.5 | 0.0084 | 2026-10-29 | LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguis | |
CVE-2026-48910 |
medium | 6.5 | 0.0056 | 2026-10-29 | A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki | |
CVE-2026-67596 |
medium | 6.9 | 0.0012 | 2026-10-29 | CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerabil | |
CVE-2026-10695 |
medium | 5.5 | 0.0014 | 2026-10-29 | IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when r |