Browse All CVEs
10,573 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-68930 |
medium | 6.5 | 0.0038 | 2026-10-29 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-sco | |
CVE-2026-18641 |
medium | 5.5 | 0.0266 | 2026-10-29 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management Sy | |
CVE-2026-18654 |
medium | 6.9 | 0.0046 | 2026-10-29 | Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CL | |
CVE-2026-58139 |
medium | 6.0 | 0.0051 | 2026-10-29 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that a | |
CVE-2026-66296 |
medium | 5.1 | 0.0037 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oas | |
CVE-2026-68979 |
medium | 5.9 | 0.0081 | 2026-10-29 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that | |
CVE-2026-69198 |
medium | 6.9 | 0.0048 | 2026-10-29 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | |
CVE-2026-18646 |
medium | 5.5 | 0.0077 | 2026-10-29 | A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects un | |
CVE-2026-18647 |
medium | 5.5 | 0.0047 | 2026-10-29 | A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4 | |
CVE-2026-18736 |
medium | 5.3 | 0.0033 | 2026-10-29 | Shlink contains a server-side request forgery vulnerability that allows authenticated API | |
CVE-2026-18738 |
medium | 5.1 | 0.0049 | 2026-10-29 | Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that all | |
CVE-2026-48061 |
medium | 5.9 | 0.0037 | 2026-10-29 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior t | |
CVE-2026-49131 |
medium | 5.1 | 0.0029 | 2026-10-29 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows au | |
CVE-2026-49132 |
medium | 5.1 | 0.0019 | 2026-10-29 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows au | |
CVE-2026-69243 |
medium | 6.3 | 0.0044 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-46714 |
medium | 5.1 | 0.0044 | 2026-10-29 | Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, bu | |
CVE-2026-48115 |
medium | 6.3 | 0.0042 | 2026-10-29 | Misskey is an open source, federated social media platform. All Misskey servers running ve | |
CVE-2026-67616 |
medium | 5.3 | 0.0044 | 2026-10-29 | Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vuln | |
CVE-2026-69248 |
medium | 6.9 | 0.0024 | 2026-10-29 | cryptography is a package designed to expose cryptographic primitives and recipes to Pytho | |
CVE-2026-11835 |
medium | 5.7 | 0.0011 | 2026-10-29 | Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in | |
CVE-2026-65804 |
medium | 6.1 | 0.0041 | 2026-10-29 | Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-base | |
CVE-2026-66311 |
medium | 6.2 | 0.0040 | 2026-10-29 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker t | |
CVE-2026-66312 |
medium | 6.5 | 0.0110 | 2026-10-29 | Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execu | |
CVE-2026-66313 |
medium | 6.8 | 0.0023 | 2026-10-29 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker | |
CVE-2026-66314 |
medium | 6.5 | 0.0057 | 2026-10-29 | Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allow | |
CVE-2026-66316 |
medium | 5.4 | 0.0021 | 2026-10-29 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker | |
CVE-2026-66317 |
medium | 5.4 | 0.0021 | 2026-10-29 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker | |
CVE-2026-66325 |
medium | 6.1 | 0.0039 | 2026-10-29 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthoriz | |
CVE-2026-66326 |
medium | 6.5 | 0.0077 | 2026-10-29 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker t | |
CVE-2026-58041 |
medium | 5.3 | 0.0029 | 2026-10-29 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through Databas | |
CVE-2026-58042 |
medium | 5.9 | 0.0037 | 2026-10-29 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Respons | |
CVE-2026-58045 |
medium | 6.2 | 0.0017 | 2026-10-29 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assert | |
CVE-2026-18720 |
medium | 5.5 | 0.0048 | 2026-10-29 | A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknow | |
CVE-2026-8508 |
medium | 6.5 | 0.0032 | 2026-10-29 | An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WA | |
CVE-2026-14192 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-14194 |
medium | 6.5 | 0.0044 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-14202 |
medium | 5.3 | 0.0033 | 2026-10-29 | Observable response discrepancy vulnerability in Bilin Software and Informatics Consultanc | |
CVE-2026-14219 |
medium | 5.4 | 0.0021 | 2026-10-29 | URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and In | |
CVE-2026-14465 |
medium | 6.5 | 0.0035 | 2026-10-29 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultanc | |
CVE-2026-18772 |
medium | 6.5 | 0.0036 | 2026-10-29 | Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rl | |
CVE-2026-66883 |
medium | 6.3 | 0.0037 | 2026-10-29 | Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_p | |
CVE-2026-18809 |
medium | 6.5 | 0.0036 | 2026-10-29 | Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerab | |
CVE-2026-61387 |
medium | 6.9 | 0.0062 | 2026-10-29 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not excep | |
CVE-2026-63248 |
medium | 6.9 | 0.0026 | 2026-10-29 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enfor | |
CVE-2026-14337 |
medium | 4.6 | 0.0042 | 2026-10-29 | Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scriptin | |
CVE-2026-11368 |
medium | 6.5 | 0.0030 | 2026-10-29 | The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT T | |
CVE-2026-18401 |
medium | 6.9 | 0.0041 | 2026-10-29 | The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumber | |
CVE-2026-18770 |
medium | 5.5 | 0.0037 | 2026-10-29 | A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60f | |
CVE-2026-67196 |
medium | 5.1 | 0.0026 | 2026-10-29 | Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plug | |
CVE-2026-10032 |
medium | 6.1 | 0.0013 | 2026-10-29 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.o |