Browse All CVEs
10,560 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-18810 |
medium | 6.9 | 0.0065 | 2026-10-29 | A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown fu | |
CVE-2026-48154 |
medium | 5.9 | 0.0040 | 2026-10-29 | GoRest is a Golang starter kit built with the Gin framework for prototyping and developing | |
CVE-2026-70588 |
medium | 5.0 | 0.0043 | 2026-10-29 | Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Impo | |
CVE-2026-70589 |
medium | 4.8 | 0.0027 | 2026-10-29 | Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validati | |
CVE-2026-70590 |
medium | 4.8 | 0.0032 | 2026-10-29 | Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was ab | |
CVE-2026-70591 |
medium | 4.1 | 0.0037 | 2026-10-29 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Requ | |
CVE-2026-70592 |
medium | 5.5 | 0.0044 | 2026-10-29 | Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-l | |
CVE-2026-70593 |
medium | 6.6 | 0.0041 | 2026-10-29 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in | |
CVE-2026-70594 |
medium | 6.7 | 0.0024 | 2026-10-29 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not | |
CVE-2026-70620 |
medium | 6.1 | 0.0046 | 2026-10-29 | Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that a | |
CVE-2026-18818 |
medium | 5.3 | 0.0037 | 2026-10-29 | A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects t | |
CVE-2026-18854 |
medium | 5.5 | 0.0041 | 2026-10-29 | A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to | |
CVE-2026-18859 |
medium | 5.5 | 0.0041 | 2026-10-29 | A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown func | |
CVE-2026-66344 |
medium | 5.4 | 0.0017 | 2026-10-29 | NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled | |
CVE-2026-71191 |
medium | 6.0 | 0.0056 | 2026-10-29 | In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* | |
CVE-2026-71192 |
medium | 6.0 | 0.0044 | 2026-10-29 | In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native con | |
CVE-2026-49004 |
medium | 6.5 | 0.0120 | 2026-10-29 | The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws a | |
CVE-2026-66275 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker could exceed the session flow control incoming window potentiall | |
CVE-2026-66276 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker can craft a disposition frame with large or illegal ranges causi | |
CVE-2026-66277 |
medium | 6.5 | 0.0065 | 2026-10-29 | It was not possible to govern the maximum number of transfer frames per incoming delivery, | |
CVE-2026-67553 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker could exceed the session flow control incoming window potentiall | |
CVE-2026-67554 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker can craft a disposition frame with large or illegal ranges causi | |
CVE-2026-67555 |
medium | 6.5 | 0.0065 | 2026-10-29 | It was not possible to govern the maximum number of transfer frames per incoming delivery, | |
CVE-2026-67591 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker could exceed the session flow control incoming window potentiall | |
CVE-2026-68075 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker could exceed the session flow control incoming window potentiall | |
CVE-2026-68077 |
medium | 6.5 | 0.0065 | 2026-10-29 | An authenticated attacker can craft a disposition frame with large or illegal ranges causi | |
CVE-2026-68078 |
medium | 6.5 | 0.0065 | 2026-10-29 | It was not possible to govern the maximum number of transfer frames per incoming delivery, | |
CVE-2026-68080 |
medium | 6.5 | 0.0065 | 2026-10-29 | It was not possible to govern the rate at which the broker would respond to an echo flow, | |
CVE-2026-71201 |
medium | 5.0 | 0.0028 | 2026-10-29 | In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironi | |
CVE-2026-55747 |
medium | 6.8 | 0.0035 | 2026-10-29 | The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper | |
CVE-2026-55996 |
medium | 4.3 | 0.0024 | 2026-10-29 | A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Bot | |
CVE-2026-55998 |
medium | 5.3 | 0.0034 | 2026-10-29 | The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before valid | |
CVE-2026-71203 |
medium | 5.3 | 0.0031 | 2026-10-29 | changedetection.io's REST API resources are protected by an @auth.check_token decorator va | |
CVE-2026-71204 |
medium | 6.2 | 0.0032 | 2026-10-29 | changedetection.io's /settings save handler builds an update dict from form.data['applicat | |
CVE-2026-71205 |
medium | 6.5 | 0.0027 | 2026-10-29 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HM | |
CVE-2026-71210 |
medium | 5.3 | 0.0023 | 2026-10-29 | Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a targ | |
CVE-2026-71212 |
medium | 4.4 | 0.0016 | 2026-10-29 | xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/cor | |
CVE-2026-0931 |
medium | 6.9 | 0.0041 | 2026-10-29 | Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an a | |
CVE-2026-14304 |
medium | 4.6 | 0.0023 | 2026-10-29 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source cod | |
CVE-2026-14574 |
medium | 5.7 | 0.0040 | 2026-10-29 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` | |
CVE-2026-71240 |
medium | 4.3 | 0.0033 | 2026-10-29 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wr | |
CVE-2026-0516 |
medium | 6.5 | 0.0034 | 2026-10-29 | A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS co | |
CVE-2026-71225 |
medium | 6.5 | 0.0034 | 2026-10-29 | A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on larg | |
CVE-2026-71227 |
medium | 5.1 | 0.0020 | 2026-10-29 | A flaw was found in libkcapi. A local attacker can influence an application that uses the | |
CVE-2026-71273 |
medium | 6.5 | 0.0017 | 2026-10-29 | OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration cha | |
CVE-2026-71275 |
medium | 5.4 | 0.0023 | 2026-10-29 | OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query par | |
CVE-2026-71283 |
medium | 4.9 | 0.0043 | 2026-10-29 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/bac | |
CVE-2026-71286 |
medium | 6.1 | 0.0026 | 2026-10-29 | The render-template component of ember-dynamic-render-template (addon/components/render-te | |
CVE-2026-71293 |
medium | 6.2 | 0.0037 | 2026-10-29 | Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.ph | |
CVE-2026-12762 |
medium | 5.3 | 0.0040 | 2026-10-29 | IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a rem |