Browse All CVEs
10,519 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-8287 |
medium | 4.3 | 0.0036 | 2026-10-29 | Allocation of resources without limits or throttling vulnerability in BizimHesap Informati | |
CVE-2026-48530 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Clas | |
CVE-2026-48531 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Rete | |
CVE-2026-48532 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File | |
CVE-2026-48534 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP | |
CVE-2026-48535 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call | |
CVE-2026-48536 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Gene | |
CVE-2026-48537 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File | |
CVE-2026-48538 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the defa | |
CVE-2026-48539 |
medium | 5.1 | 0.0024 | 2026-10-29 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Mail | |
CVE-2026-65696 |
medium | 5.3 | 0.0026 | 2026-10-29 | Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vuln | |
CVE-2026-65697 |
medium | 5.1 | 0.0027 | 2026-10-29 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the anal | |
CVE-2026-65698 |
medium | 6.0 | 0.0047 | 2026-10-29 | Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading to | |
CVE-2026-47755 |
medium | 6.5 | 0.0035 | 2026-10-29 | ITFlow provides an IT documentation, ticketing and accounting system for small managed ser | |
CVE-2026-47769 |
medium | 5.3 | 0.0047 | 2026-10-29 | APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production | |
CVE-2026-65762 |
medium | 5.1 | 0.0044 | 2026-10-29 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - | |
CVE-2026-65763 |
medium | 5.1 | 0.0044 | 2026-10-29 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Impr | |
CVE-2026-65920 |
medium | 5.3 | 0.0040 | 2026-10-29 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability | |
CVE-2026-65010 |
medium | 4.4 | 0.0017 | 2026-10-29 | Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability | |
CVE-2026-64785 |
medium | 5.3 | 0.0029 | 2026-10-29 | SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP | |
CVE-2026-15968 |
medium | 5.4 | 0.0033 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-16765 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue i | |
CVE-2026-16767 |
medium | 5.5 | 0.0068 | 2026-10-29 | A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function Zip | |
CVE-2026-44955 |
medium | 6.9 | 0.0034 | 2026-10-29 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system inform | |
CVE-2026-49159 |
medium | 6.5 | 0.0100 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an au | |
CVE-2026-11922 |
medium | 6.5 | 0.0022 | 2026-10-29 | A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to byp | |
CVE-2026-54422 |
medium | 5.5 | 0.0015 | 2026-10-29 | In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deploye | |
CVE-2026-66139 |
medium | 4.8 | 0.0048 | 2026-10-29 | OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when | |
CVE-2026-12702 |
medium | 5.1 | 0.0033 | 2026-10-29 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions | |
CVE-2026-56391 |
medium | 4.6 | 0.0013 | 2026-10-29 | GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of mul | |
CVE-2026-63317 |
medium | 5.6 | 0.0085 | 2026-10-29 | Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apac | |
CVE-2026-45812 |
medium | 6.5 | 0.0069 | 2026-10-29 | Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy | |
CVE-2026-46452 |
medium | 5.3 | 0.0091 | 2026-10-29 | Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly coul | |
CVE-2026-66008 |
medium | 6.3 | 0.0056 | 2026-10-29 | Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose P | |
CVE-2026-66009 |
medium | 6.3 | 0.0044 | 2026-10-29 | Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return Gra | |
CVE-2026-66010 |
medium | 5.1 | 0.0022 | 2026-10-29 | DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements al | |
CVE-2026-7484 |
medium | 5.3 | 0.0033 | 2026-10-29 | External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. | |
CVE-2026-16798 |
medium | 6.5 | 0.0038 | 2026-10-29 | Insertion of sensitive information into sent data in the automation jobs API in Devolution | |
CVE-2026-16799 |
medium | 5.0 | 0.0025 | 2026-10-29 | Improper access control in the automation tests and workflows features in Devolutions Powe | |
CVE-2026-16802 |
medium | 6.5 | 0.0010 | 2026-10-29 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerSh | |
CVE-2026-49326 |
medium | 6.5 | 0.0049 | 2026-10-29 | Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A | |
CVE-2026-66004 |
medium | 6.0 | 0.0030 | 2026-10-29 | BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_p | |
CVE-2026-66005 |
medium | 5.3 | 0.0033 | 2026-10-29 | Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability | |
CVE-2026-66006 |
medium | 6.9 | 0.0056 | 2026-10-29 | lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerab | |
CVE-2026-66007 |
medium | 6.9 | 0.0055 | 2026-10-29 | Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability i | |
CVE-2026-7007 |
medium | 4.6 | 0.0024 | 2026-10-29 | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superbloc | |
CVE-2026-8308 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-64236 |
medium | 5.5 | 0.0016 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix div | |
CVE-2026-48037 |
medium | 6.3 | 0.0045 | 2026-10-29 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastru | |
CVE-2026-55985 |
medium | 5.3 | 0.0019 | 2026-10-29 | The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays syst |