Browse All CVEs
10,519 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-15319 |
medium | 5.5 | 0.0054 | 2026-10-29 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects th | |
CVE-2026-44918 |
medium | 5.5 | 0.0041 | 2026-10-29 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-proj | |
CVE-2026-15330 |
medium | 5.5 | 0.0060 | 2026-10-29 | A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function | |
CVE-2026-15331 |
medium | 5.3 | 0.0044 | 2026-10-29 | A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is t | |
CVE-2026-21039 |
medium | 6.9 | 0.0015 | 2026-10-29 | Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers | |
CVE-2026-21040 |
medium | 6.9 | 0.0013 | 2026-10-29 | Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privil | |
CVE-2026-21041 |
medium | 6.9 | 0.0015 | 2026-10-29 | Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows lo | |
CVE-2026-21043 |
medium | 6.7 | 0.0017 | 2026-10-29 | Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privilege | |
CVE-2026-21044 |
medium | 5.8 | 0.0014 | 2026-10-29 | Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local at | |
CVE-2026-21050 |
medium | 5.1 | 0.0015 | 2026-10-29 | Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local att | |
CVE-2026-21051 |
medium | 5.1 | 0.0015 | 2026-10-29 | Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows loca | |
CVE-2026-21052 |
medium | 6.8 | 0.0016 | 2026-10-29 | Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privile | |
CVE-2026-21053 |
medium | 5.1 | 0.0016 | 2026-10-29 | Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attacker | |
CVE-2026-21054 |
medium | 6.9 | 0.0015 | 2026-10-29 | Improper export of android application components in InputSharing prior to version 2.7.01. | |
CVE-2026-21056 |
medium | 4.8 | 0.0013 | 2026-10-29 | Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attacker | |
CVE-2026-21057 |
medium | 6.8 | 0.0015 | 2026-10-29 | Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privilege | |
CVE-2026-40009 |
medium | 6.5 | 0.0035 | 2026-10-29 | Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Auth | |
CVE-2026-41877 |
medium | 5.1 | 0.0039 | 2026-10-29 | R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacke | |
CVE-2026-14461 |
medium | 5.1 | 0.0044 | 2026-10-29 | mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attac | |
CVE-2026-54468 |
medium | 6.5 | 0.0045 | 2026-10-29 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vu | |
CVE-2026-56814 |
medium | 6.9 | 0.0108 | 2026-10-29 | Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and | |
CVE-2026-54470 |
medium | 5.3 | 0.0030 | 2026-10-29 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restrict | |
CVE-2026-56309 |
medium | 5.3 | 0.0031 | 2026-10-29 | Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attach | |
CVE-2026-56312 |
medium | 6.9 | 0.0038 | 2026-10-29 | Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitati | |
CVE-2026-56366 |
medium | 4.8 | 0.0017 | 2026-10-29 | ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when p | |
CVE-2026-56373 |
medium | 6.3 | 0.0023 | 2026-10-29 | ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder tha | |
CVE-2026-58661 |
medium | 5.3 | 0.0039 | 2026-10-29 | n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion | |
CVE-2026-59794 |
medium | 5.4 | 0.0032 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible vi | |
CVE-2026-59795 |
medium | 6.1 | 0.0034 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration wa | |
CVE-2026-60086 |
medium | 6.9 | 0.0027 | 2026-10-29 | PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the | |
CVE-2026-60089 |
medium | 6.9 | 0.0020 | 2026-10-29 | PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a | |
CVE-2026-60091 |
medium | 6.9 | 0.0022 | 2026-10-29 | PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerabil | |
CVE-2026-61431 |
medium | 6.8 | 0.0037 | 2026-10-29 | PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fa | |
CVE-2026-61432 |
medium | 6.9 | 0.0034 | 2026-10-29 | PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the F | |
CVE-2026-61456 |
medium | 5.1 | 0.0017 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files upl | |
CVE-2026-61492 |
medium | 6.1 | 0.0066 | 2026-10-29 | In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails w | |
CVE-2026-8595 |
medium | 5.4 | 0.0024 | 2026-10-29 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains | |
CVE-2026-3251 |
medium | 6.4 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-55885 |
medium | 6.8 | 0.0022 | 2026-10-29 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with ba | |
CVE-2026-55890 |
medium | 4.8 | 0.0050 | 2026-10-29 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored X | |
CVE-2026-57167 |
medium | 5.1 | 0.0047 | 2026-10-29 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side | |
CVE-2026-58493 |
medium | 5.1 | 0.0037 | 2026-10-29 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call | |
CVE-2026-59162 |
medium | 6.9 | 0.0066 | 2026-10-29 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Pr | |
CVE-2026-59193 |
medium | 6.9 | 0.0060 | 2026-10-29 | Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can c | |
CVE-2026-57474 |
medium | 6.9 | 0.0051 | 2026-10-29 | Deloitte AI Assist for Customer disclosed some configuration information through public-fa | |
CVE-2026-57475 |
medium | 6.9 | 0.0060 | 2026-10-29 | Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-faci | |
CVE-2026-57476 |
medium | 6.3 | 0.0044 | 2026-10-29 | Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an atta | |
CVE-2026-15146 |
medium | 5.9 | 0.0017 | 2026-10-29 | GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PA | |
CVE-2026-55464 |
medium | 4.8 | 0.0029 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw | |
CVE-2026-55472 |
medium | 4.3 | 0.0033 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Comp |