Browse All CVEs
10,519 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-64710 |
medium | 5.5 | 0.0016 | 2026-10-29 | A privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Seq | |
CVE-2026-64723 |
medium | 5.5 | 0.0015 | 2026-10-29 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and i | |
CVE-2026-64732 |
medium | 4.6 | 0.0020 | 2026-10-29 | This issue was addressed through improved state management. This issue is fixed in iOS 18. | |
CVE-2026-64744 |
medium | 5.5 | 0.0016 | 2026-10-29 | An information leakage was addressed with additional validation. This issue is fixed in iO | |
CVE-2026-53666 |
medium | 6.1 | 0.0042 | 2026-10-29 | React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code | |
CVE-2026-53667 |
medium | 6.1 | 0.0036 | 2026-10-29 | React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler | |
CVE-2026-53668 |
medium | 6.9 | 0.0034 | 2026-10-29 | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7. | |
CVE-2026-53669 |
medium | 5.1 | 0.0032 | 2026-10-29 | React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open R | |
CVE-2026-59240 |
medium | 6.9 | 0.0048 | 2026-10-29 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotifi | |
CVE-2026-65445 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versio | |
CVE-2026-8167 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-9680 |
medium | 5.8 | 0.0040 | 2026-10-29 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote a | |
CVE-2026-58246 |
medium | 4.3 | 0.0024 | 2026-10-29 | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session ident | |
CVE-2026-65624 |
medium | 6.9 | 0.0038 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy all | |
CVE-2026-18029 |
medium | 6.3 | 0.0033 | 2026-10-29 | Our payment integration with GiroCheckout did not properly validate payment status respon | |
CVE-2026-63302 |
medium | 5.1 | 0.0053 | 2026-10-29 | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p | |
CVE-2026-63303 |
medium | 5.1 | 0.0057 | 2026-10-29 | A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP | |
CVE-2026-4648 |
medium | 6.8 | 0.0016 | 2026-10-29 | Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristb | |
CVE-2026-41874 |
medium | 6.8 | 0.0018 | 2026-10-29 | Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This fl | |
CVE-2026-65882 |
medium | 6.1 | 0.0025 | 2026-10-29 | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto | |
CVE-2026-66921 |
medium | 6.3 | 0.0044 | 2026-10-29 | Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled | |
CVE-2026-66299 |
medium | 5.3 | 0.0055 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. | |
CVE-2026-15204 |
medium | 5.5 | 0.0060 | 2026-10-29 | A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230 | |
CVE-2026-43752 |
medium | 4.9 | 0.0049 | 2026-10-29 | An authenticated administrator may be able to achieve arbitrary code execution on the host | |
CVE-2026-59817 |
medium | 5.3 | 0.0040 | 2026-10-29 | Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public do | |
CVE-2026-61344 |
medium | 6.9 | 0.0047 | 2026-10-29 | The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov | |
CVE-2026-0285 |
medium | 4.7 | 0.0043 | 2026-10-29 | A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software e | |
CVE-2026-49274 |
medium | 5.3 | 0.0048 | 2026-10-29 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites u | |
CVE-2026-50188 |
medium | 6.9 | 0.0044 | 2026-10-29 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites a | |
CVE-2026-54004 |
medium | 6.3 | 0.0050 | 2026-10-29 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites w | |
CVE-2026-54695 |
medium | 6.5 | 0.0056 | 2026-10-29 | Pipecat is an open-source Python framework for building real-time voice and multimodal con | |
CVE-2026-55590 |
medium | 5.1 | 0.0049 | 2026-10-29 | CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PS | |
CVE-2026-58198 |
medium | 5.5 | 0.0014 | 2026-10-29 | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Pri | |
CVE-2026-0277 |
medium | 5.7 | 0.0020 | 2026-10-29 | An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enabl | |
CVE-2026-0278 |
medium | 5.8 | 0.0015 | 2026-10-29 | Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DL | |
CVE-2026-15270 |
medium | 6.8 | 0.0085 | 2026-10-29 | A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vuln | |
CVE-2026-31267 |
medium | 5.7 | 0.0032 | 2026-10-29 | Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the | |
CVE-2026-60120 |
medium | 5.1 | 0.0036 | 2026-10-29 | Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side | |
CVE-2026-33802 |
medium | 6.8 | 0.0012 | 2026-10-29 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series | |
CVE-2026-33803 |
medium | 6.9 | 0.0035 | 2026-10-29 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Ju | |
CVE-2026-55605 |
medium | 5.3 | 0.0052 | 2026-10-29 | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior | |
CVE-2026-57021 |
medium | 6.9 | 0.0047 | 2026-10-29 | An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks | |
CVE-2026-57024 |
medium | 6.9 | 0.0042 | 2026-10-29 | A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (ike | |
CVE-2026-57028 |
medium | 6.9 | 0.0030 | 2026-10-29 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Ju | |
CVE-2026-57029 |
medium | 6.0 | 0.0019 | 2026-10-29 | A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks | |
CVE-2026-57031 |
medium | 5.3 | 0.0022 | 2026-10-29 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwar | |
CVE-2026-57054 |
medium | 6.9 | 0.0037 | 2026-10-29 | A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin | |
CVE-2026-44342 |
medium | 5.3 | 0.0019 | 2026-10-29 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset mana | |
CVE-2026-59853 |
medium | 6.5 | 0.0030 | 2026-10-29 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/st | |
CVE-2026-59854 |
medium | 4.9 | 0.0049 | 2026-10-29 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/f |