Browse All CVEs
14,879 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-112775 |
high | 8.7 | 0.0040 | 2026-10-29 | Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that al | |
CVE-2026-112390 |
high | 8.2 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite | |
CVE-2026-112392 |
high | 8.2 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can deref | |
CVE-2026-112396 |
high | 7.5 | 0.0069 | 2026-10-29 | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after- | |
CVE-2026-112397 |
high | 8.7 | 0.0057 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() c | |
CVE-2026-112399 |
high | 8.7 | 0.0053 | 2026-10-29 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG d | |
CVE-2026-112400 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected | |
CVE-2026-112402 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory w | |
CVE-2026-112404 |
high | 8.8 | 0.0044 | 2026-10-29 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA d | |
CVE-2026-112405 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can d | |
CVE-2026-112406 |
high | 8.7 | 0.0057 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite | |
CVE-2026-112892 |
high | 8.7 | 0.0050 | 2026-10-29 | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can | |
CVE-2026-112893 |
high | 8.2 | 0.0055 | 2026-10-29 | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid g | |
CVE-2026-112894 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time t | |
CVE-2026-112895 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources | |
CVE-2026-112896 |
high | 8.8 | 0.0047 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond | |
CVE-2026-112897 |
high | 8.7 | 0.0048 | 2026-10-29 | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitializ | |
CVE-2026-112370 |
high | 8.6 | 0.0203 | 2026-10-29 | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_4 | |
CVE-2026-109440 |
high | 8.7 | 0.0060 | 2026-10-29 | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allo | |
CVE-2026-113386 |
high | 7.1 | 0.0100 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command inject | |
CVE-2026-113405 |
high | 8.7 | 0.0052 | 2026-10-29 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remo | |
CVE-2026-113406 |
high | 8.7 | 0.0052 | 2026-10-29 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remo | |
CVE-2026-113354 |
high | 7.1 | 0.0037 | 2026-10-29 | Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin | |
CVE-2026-105949 |
high | 8.8 | 0.0033 | 2026-10-29 | Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact p | |
CVE-2026-113390 |
high | 8.6 | 0.0186 | 2026-10-29 | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue i | |
CVE-2026-112940 |
high | 7.1 | 0.0019 | 2026-10-29 | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWrit | |
CVE-2025-71436 |
high | 7.1 | 0.0050 | 2026-10-29 | Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow | |
CVE-2026-111765 |
high | 7.5 | 0.0080 | 2026-10-29 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in vers | |
CVE-2026-113606 |
high | 7.1 | 0.0036 | 2026-10-29 | Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allow | |
CVE-2026-113658 |
high | 7.5 | 0.0062 | 2026-10-29 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the un | |
CVE-2026-111756 |
high | 8.2 | 0.0047 | 2026-10-29 | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows red | |
CVE-2026-113718 |
high | 7.1 | 0.0024 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, | |
CVE-2026-113722 |
high | 7.8 | 0.0029 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, | |
CVE-2026-113723 |
high | 7.1 | 0.0024 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, | |
CVE-2026-113725 |
high | 7.8 | 0.0026 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, | |
CVE-2026-86409 |
high | 8.1 | 0.0110 | 2026-10-29 | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to | |
CVE-2026-86410 |
high | 8.1 | 0.0077 | 2026-10-29 | A flaw in the curl command line tool's logic makes it only set SSH host verification optio | |
CVE-2026-86412 |
high | 8.1 | 0.0083 | 2026-10-29 | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie ja | |
CVE-2012-20002 |
high | 8.7 | 0.0053 | 2026-10-29 | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vuln | |
CVE-2014-125133 |
high | 8.7 | 0.0112 | 2026-10-29 | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that | |
CVE-2014-125134 |
high | 8.7 | 0.0082 | 2026-10-29 | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allo | |
CVE-2015-20123 |
high | 8.7 | 0.0041 | 2026-10-29 | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerabilit | |
CVE-2015-20124 |
high | 8.7 | 0.0050 | 2026-10-29 | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulne | |
CVE-2015-20125 |
high | 8.7 | 0.0041 | 2026-10-29 | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerabilit | |
CVE-2015-20128 |
high | 8.8 | 0.0034 | 2026-10-29 | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthent | |
CVE-2016-20100 |
high | 8.7 | 0.0053 | 2026-10-29 | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vuln | |
CVE-2016-20103 |
high | 8.7 | 0.0061 | 2026-10-29 | Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allo | |
CVE-2016-20104 |
high | 8.7 | 0.0061 | 2026-10-29 | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vul | |
CVE-2026-107928 |
high | 8.1 | 0.0070 | 2026-10-29 | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory pas | |
CVE-2026-107929 |
high | 8.1 | 0.0067 | 2026-10-29 | When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one |