Browse All CVEs
10,534 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-63142 |
medium | 5.0 | 0.0029 | 2026-10-29 | Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attack | |
CVE-2026-63143 |
medium | 4.3 | 0.0033 | 2026-10-29 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure | |
CVE-2026-63144 |
medium | 6.5 | 0.0042 | 2026-10-29 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a spec | |
CVE-2026-63145 |
medium | 4.3 | 0.0027 | 2026-10-29 | Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Le | |
CVE-2026-63259 |
medium | 4.3 | 0.0029 | 2026-10-29 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to informati | |
CVE-2026-63260 |
medium | 6.5 | 0.0047 | 2026-10-29 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Ex | |
CVE-2026-63261 |
medium | 6.5 | 0.0047 | 2026-10-29 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Ex | |
CVE-2026-63262 |
medium | 4.3 | 0.0028 | 2026-10-29 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information | |
CVE-2026-63263 |
medium | 6.5 | 0.0047 | 2026-10-29 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service | |
CVE-2026-45820 |
medium | 6.6 | 0.0028 | 2026-10-29 | fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync( | |
CVE-2026-63264 |
medium | 5.3 | 0.0044 | 2026-10-29 | Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla | |
CVE-2026-16544 |
medium | 6.5 | 0.0039 | 2026-10-29 | A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks o | |
CVE-2026-16551 |
medium | 6.9 | 0.0043 | 2026-10-29 | Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive | |
CVE-2026-44192 |
medium | 6.6 | 0.0020 | 2026-10-29 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulne | |
CVE-2026-57599 |
medium | 6.6 | 0.0036 | 2026-10-29 | There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect | |
CVE-2026-65014 |
medium | 6.3 | 0.0059 | 2026-10-29 | n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEnd | |
CVE-2026-65589 |
medium | 5.1 | 0.0048 | 2026-10-29 | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM s | |
CVE-2026-65590 |
medium | 5.5 | 0.0058 | 2026-10-29 | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on | |
CVE-2026-65593 |
medium | 6.3 | 0.0024 | 2026-10-29 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vul | |
CVE-2026-65594 |
medium | 5.1 | 0.0044 | 2026-10-29 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 conse | |
CVE-2026-65596 |
medium | 5.1 | 0.0037 | 2026-10-29 | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains | |
CVE-2026-65599 |
medium | 5.1 | 0.0025 | 2026-10-29 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerabili | |
CVE-2026-13188 |
medium | 5.9 | 0.0016 | 2026-10-29 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters m | |
CVE-2026-13192 |
medium | 6.5 | 0.0042 | 2026-10-29 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content | |
CVE-2026-14586 |
medium | 5.9 | 0.0037 | 2026-10-29 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, wi | |
CVE-2026-14865 |
medium | 5.3 | 0.0043 | 2026-10-29 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control | |
CVE-2026-14932 |
medium | 6.5 | 0.0035 | 2026-10-29 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's | |
CVE-2026-44621 |
medium | 5.9 | 0.0025 | 2026-10-29 | With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound | |
CVE-2026-50045 |
medium | 5.3 | 0.0046 | 2026-10-29 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deepl | |
CVE-2026-50046 |
medium | 5.9 | 0.0024 | 2026-10-29 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS- | |
CVE-2026-50243 |
medium | 6.3 | 0.0011 | 2026-10-29 | In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with th | |
CVE-2026-50248 |
medium | 6.5 | 0.0013 | 2026-10-29 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a config | |
CVE-2026-50251 |
medium | 5.3 | 0.0025 | 2026-10-29 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' | |
CVE-2026-50252 |
medium | 5.7 | 0.0017 | 2026-10-29 | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and | |
CVE-2026-52863 |
medium | 5.9 | 0.0037 | 2026-10-29 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and | |
CVE-2026-55717 |
medium | 5.9 | 0.0024 | 2026-10-29 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set | |
CVE-2026-55990 |
medium | 5.9 | 0.0025 | 2026-10-29 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists | |
CVE-2026-55991 |
medium | 5.9 | 0.0037 | 2026-10-29 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client c | |
CVE-2026-56416 |
medium | 4.8 | 0.0012 | 2026-10-29 | In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the ca | |
CVE-2026-56444 |
medium | 5.9 | 0.0037 | 2026-10-29 | In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with ' | |
CVE-2026-10723 |
medium | 6.8 | 0.0027 | 2026-10-29 | BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker | |
CVE-2026-10822 |
medium | 6.5 | 0.0038 | 2026-10-29 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the | |
CVE-2026-44276 |
medium | 4.4 | 0.0015 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sens | |
CVE-2026-64828 |
medium | 5.3 | 0.0037 | 2026-10-29 | Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability tha | |
CVE-2026-65011 |
medium | 5.3 | 0.0038 | 2026-10-29 | Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in th | |
CVE-2026-65012 |
medium | 6.3 | 0.0044 | 2026-10-29 | InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in | |
CVE-2026-7328 |
medium | 6.8 | 0.0013 | 2026-10-29 | Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DE | |
CVE-2026-13057 |
medium | 6.0 | 0.0035 | 2026-10-29 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass p | |
CVE-2026-13061 |
medium | 5.3 | 0.0028 | 2026-10-29 | An authenticated user may be able to view session metadata belonging to other users on the | |
CVE-2026-13063 |
medium | 5.3 | 0.0040 | 2026-10-29 | An authenticated user with standard read/write privileges can cause the mongod process to |