Browse All CVEs
3,490 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-77930 |
critical | 9.3 | 0.0069 | 2026-10-29 | EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows atta | |
CVE-2026-113678 |
critical | 9.4 | 0.0063 | 2026-10-29 | Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownW | |
CVE-2026-113682 |
critical | 9.1 | 0.0056 | 2026-10-29 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability | |
CVE-2026-113672 |
critical | 9.9 | 0.0084 | 2026-10-29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until | |
CVE-2026-112380 |
critical | 9.0 | 0.0041 | 2026-10-29 | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote acto | |
CVE-2026-113867 |
critical | 9.1 | 0.0040 | 2026-10-29 | Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Becaus | |
CVE-2026-86411 |
critical | 9.1 | 0.0015 | 2026-10-29 | An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control conn | |
CVE-2026-86413 |
critical | 9.1 | 0.0032 | 2026-10-29 | When using an *ambient user* in a first transfer doing Negotiate authentication and asked | |
CVE-2016-20101 |
critical | 9.2 | 0.0040 | 2026-10-29 | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability | |
CVE-2026-10131 |
critical | 9.1 | 0.0139 | 2026-10-29 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of | |
CVE-2026-10132 |
critical | 9.1 | 0.0060 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality | |
CVE-2026-10133 |
critical | 9.1 | 0.0060 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R | |
CVE-2026-10135 |
critical | 9.1 | 0.0139 | 2026-10-29 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (versi | |
CVE-2026-10136 |
critical | 9.1 | 0.0060 | 2026-10-29 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of | |
CVE-2026-10137 |
critical | 9.1 | 0.0060 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality o | |
CVE-2026-10138 |
critical | 9.1 | 0.0145 | 2026-10-29 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000 | |
CVE-2026-10139 |
critical | 9.1 | 0.0062 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (ve | |
CVE-2026-10141 |
critical | 9.1 | 0.0028 | 2026-10-29 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000 | |
CVE-2026-112712 |
critical | 9.1 | 0.0031 | 2026-10-29 | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 | |
CVE-2026-28763 |
critical | 9.1 | 0.0074 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname fu | |
CVE-2026-33568 |
critical | 9.1 | 0.0104 | 2026-10-29 | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionali | |
CVE-2026-35499 |
critical | 9.1 | 0.0129 | 2026-10-29 | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality o | |
CVE-2026-40615 |
critical | 9.1 | 0.0074 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName | |
CVE-2026-40627 |
critical | 9.1 | 0.0104 | 2026-10-29 | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality | |
CVE-2026-41222 |
critical | 9.1 | 0.0074 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functi | |
CVE-2026-41223 |
critical | 9.1 | 0.0074 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr func | |
CVE-2026-42019 |
critical | 9.1 | 0.0074 | 2026-10-29 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe | |
CVE-2026-42020 |
critical | 9.1 | 0.0074 | 2026-10-29 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe | |
CVE-2026-42021 |
critical | 9.1 | 0.0048 | 2026-10-29 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42022 |
critical | 9.1 | 0.0048 | 2026-10-29 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42023 |
critical | 9.1 | 0.0051 | 2026-10-29 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42024 |
critical | 9.1 | 0.0051 | 2026-10-29 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42025 |
critical | 9.1 | 0.0051 | 2026-10-29 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6 | |
CVE-2026-42026 |
critical | 9.1 | 0.0051 | 2026-10-29 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6 | |
CVE-2026-86414 |
critical | 9.1 | 0.0027 | 2026-10-29 | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or | |
CVE-2026-87861 |
critical | 9.1 | 0.0027 | 2026-10-29 | When using ambient user credentials, an HTTP request directed to one origin may be dispatc | |
CVE-2026-87866 |
critical | 9.1 | 0.0021 | 2026-10-29 | When built with wolfSSL, curl can successfully validate a pinned public key hash against a | |
CVE-2026-92388 |
critical | 9.1 | 0.0026 | 2026-10-29 | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for | |
CVE-2026-9659 |
critical | 9.1 | 0.0079 | 2026-10-29 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilt | |
CVE-2026-9660 |
critical | 9.1 | 0.0051 | 2026-10-29 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilt | |
CVE-2026-9814 |
critical | 9.1 | 0.0160 | 2026-10-29 | An OS command injection vulnerability exists in the boa formWizard newPass functionality o | |
CVE-2026-9817 |
critical | 9.1 | 0.0051 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality | |
CVE-2026-9827 |
critical | 9.1 | 0.0063 | 2026-10-29 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X20 | |
CVE-2026-9869 |
critical | 9.1 | 0.0051 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionalit | |
CVE-2026-101420 |
critical | 9.6 | 0.0037 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101484 |
critical | 9.8 | 0.0054 | 2026-10-29 | Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions | |
CVE-2026-101521 |
critical | 9.8 | 0.0058 | 2026-10-29 | Vulnerability in Oracle APEX (component: General). Supported versions that are affected a | |
CVE-2026-101590 |
critical | 9.1 | 0.0042 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-micro | |
CVE-2026-101809 |
critical | 10.0 | 0.0054 | 2026-10-29 | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Noti | |
CVE-2026-112992 |
critical | 9.6 | 0.0047 | 2026-10-29 | Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attac |