Browse All CVEs
10,576 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65834 |
medium | 6.8 | 0.0032 | 2026-10-29 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, Cap | |
CVE-2026-65835 |
medium | 6.6 | 0.0024 | 2026-10-29 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0. | |
CVE-2026-66755 |
medium | 5.9 | 0.0063 | 2026-10-29 | Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika fr | |
CVE-2026-66756 |
medium | 6.9 | 0.0075 | 2026-10-29 | Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Ap | |
CVE-2026-67528 |
medium | 4.3 | 0.0036 | 2026-10-29 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /a | |
CVE-2026-67529 |
medium | 4.3 | 0.0041 | 2026-10-29 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /a | |
CVE-2026-67530 |
medium | 6.4 | 0.0026 | 2026-10-29 | WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation s | |
CVE-2026-67550 |
medium | 5.7 | 0.0016 | 2026-10-29 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, | |
CVE-2026-55777 |
medium | 5.3 | 0.0044 | 2026-10-29 | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in | |
CVE-2026-61526 |
medium | 6.1 | 0.0034 | 2026-10-29 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In | |
CVE-2026-68499 |
medium | 6.2 | 0.0018 | 2026-10-29 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, | |
CVE-2026-68501 |
medium | 6.5 | 0.0087 | 2026-10-29 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to | |
CVE-2026-62845 |
medium | 4.7 | 0.0032 | 2026-10-29 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the Postg | |
CVE-2026-68563 |
medium | 5.5 | 0.0011 | 2026-10-29 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed w | |
CVE-2026-10031 |
medium | 5.3 | 0.0019 | 2026-10-29 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated | |
CVE-2026-56758 |
medium | 6.9 | 0.0029 | 2026-10-29 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection estab | |
CVE-2026-61893 |
medium | 6.9 | 0.0046 | 2026-10-29 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object coun | |
CVE-2026-63033 |
medium | 6.9 | 0.0046 | 2026-10-29 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the | |
CVE-2026-66349 |
medium | 6.9 | 0.0029 | 2026-10-29 | The MMS server connection handler contains a flaw in its processing of BER-encoded reques | |
CVE-2026-14538 |
medium | 5.7 | 0.0020 | 2026-10-29 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execu | |
CVE-2026-14539 |
medium | 6.6 | 0.0024 | 2026-10-29 | An allocation of resources without limits vulnerability in the HTTP handler component of G | |
CVE-2026-44615 |
medium | 6.5 | 0.0080 | 2026-10-29 | Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured | |
CVE-2026-64607 |
medium | 5.3 | 0.0046 | 2026-10-29 | HttpClient based on the classic i/o model fails to correctly release the underlying connec | |
CVE-2026-46594 |
medium | 5.1 | 0.0055 | 2026-10-29 | A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabber | |
CVE-2026-15227 |
medium | 5.3 | 0.0035 | 2026-10-29 | Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows a | |
CVE-2026-28144 |
medium | 4.3 | 0.0029 | 2026-10-29 | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps al | |
CVE-2026-28145 |
medium | 5.3 | 0.0016 | 2026-10-29 | Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy | |
CVE-2026-17348 |
medium | 6.9 | 0.0042 | 2026-10-29 | In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required de | |
CVE-2026-17350 |
medium | 5.3 | 0.0038 | 2026-10-29 | The per-tool permission system (custom roles / role-based tool permissions, introduced in | |
CVE-2026-52857 |
medium | 5.5 | 0.0016 | 2026-10-29 | Wings is the server control plane for Pterodactyl, a free, open-source game server managem | |
CVE-2026-56568 |
medium | 5.3 | 0.0033 | 2026-10-29 | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Me | |
CVE-2026-56570 |
medium | 5.3 | 0.0030 | 2026-10-29 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sen | |
CVE-2026-56571 |
medium | 5.3 | 0.0029 | 2026-10-29 | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of m | |
CVE-2026-59231 |
medium | 5.3 | 0.0045 | 2026-10-29 | Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 | |
CVE-2026-59232 |
medium | 5.3 | 0.0053 | 2026-10-29 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allow | |
CVE-2026-21662 |
medium | 4.8 | 0.0050 | 2026-10-29 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Syste | |
CVE-2026-34490 |
medium | 4.8 | 0.0010 | 2026-10-29 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Applicat | |
CVE-2026-34495 |
medium | 4.8 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-34497 |
medium | 4.8 | 0.0023 | 2026-10-29 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerabilit | |
CVE-2026-18481 |
medium | 6.2 | 0.0051 | 2026-10-29 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #1 | |
CVE-2026-25552 |
medium | 6.3 | 0.0022 | 2026-10-29 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated | |
CVE-2026-18394 |
medium | 6.9 | 0.0052 | 2026-10-29 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 migh | |
CVE-2026-62324 |
medium | 5.4 | 0.0031 | 2026-10-29 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.1 | |
CVE-2026-65841 |
medium | 5.3 | 0.0053 | 2026-10-29 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.1 | |
CVE-2026-53573 |
medium | 4.8 | 0.0065 | 2026-10-29 | GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 | |
CVE-2026-54785 |
medium | 6.2 | 0.0019 | 2026-10-29 | gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the | |
CVE-2026-54909 |
medium | 5.3 | 0.0064 | 2026-10-29 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can p | |
CVE-2026-10773 |
medium | 5.4 | 0.0027 | 2026-10-29 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c inde | |
CVE-2026-2411 |
medium | 6.5 | 0.0018 | 2026-10-29 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Ch | |
CVE-2026-67332 |
medium | 5.3 | 0.0026 | 2026-10-29 | @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the |