Browse All CVEs
10,517 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54714 |
medium | 6.1 | 0.0034 | 2026-10-29 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0 | |
CVE-2026-55370 |
medium | 6.4 | 0.0034 | 2026-10-29 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0 | |
CVE-2026-55452 |
medium | 4.8 | 0.0043 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() | |
CVE-2026-55461 |
medium | 6.1 | 0.0031 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stor | |
CVE-2026-55462 |
medium | 4.3 | 0.0034 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() | |
CVE-2026-55466 |
medium | 6.2 | 0.0044 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanit | |
CVE-2026-55469 |
medium | 6.5 | 0.0059 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user w | |
CVE-2026-55475 |
medium | 5.7 | 0.0034 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoi | |
CVE-2026-55479 |
medium | 5.3 | 0.0032 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat | |
CVE-2026-55481 |
medium | 6.2 | 0.0032 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php rende | |
CVE-2026-55515 |
medium | 5.0 | 0.0034 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets r | |
CVE-2026-55664 |
medium | 4.3 | 0.0033 | 2026-10-29 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the G | |
CVE-2026-57213 |
medium | 5.7 | 0.0025 | 2026-10-29 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, | |
CVE-2026-57218 |
medium | 4.9 | 0.0035 | 2026-10-29 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows a | |
CVE-2026-57221 |
medium | 5.3 | 0.0041 | 2026-10-29 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, | |
CVE-2026-57575 |
medium | 6.9 | 0.0060 | 2026-10-29 | Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey con | |
CVE-2026-10769 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-10770 |
medium | 6.1 | 0.0026 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-11908 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-13231 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-13234 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-13236 |
medium | 4.2 | 0.0019 | 2026-10-29 | Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This iss | |
CVE-2026-13237 |
medium | 4.8 | 0.0022 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This i | |
CVE-2026-13238 |
medium | 4.8 | 0.0022 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows F | |
CVE-2026-13239 |
medium | 6.5 | 0.0027 | 2026-10-29 | Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue | |
CVE-2026-13240 |
medium | 6.5 | 0.0027 | 2026-10-29 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This is | |
CVE-2026-13241 |
medium | 6.5 | 0.0027 | 2026-10-29 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This is | |
CVE-2026-13242 |
medium | 6.5 | 0.0028 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-13243 |
medium | 4.8 | 0.0012 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Si | |
CVE-2026-15079 |
medium | 5.4 | 0.0028 | 2026-10-29 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Di | |
CVE-2026-15080 |
medium | 4.3 | 0.0014 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allow | |
CVE-2026-15082 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-15083 |
medium | 4.2 | 0.0023 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-15084 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-15085 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-49844 |
medium | 6.3 | 0.0060 | 2026-10-29 | Improper encoding of non-finite floating-point values during MapMessage JSON serialization | |
CVE-2026-52761 |
medium | 5.3 | 0.0041 | 2026-10-29 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Ap | |
CVE-2026-55187 |
medium | 5.8 | 0.0035 | 2026-10-29 | Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation | |
CVE-2026-55803 |
medium | 5.9 | 0.0035 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-55804 |
medium | 5.9 | 0.0035 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-55806 |
medium | 5.9 | 0.0034 | 2026-10-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core al | |
CVE-2026-55808 |
medium | 5.4 | 0.0027 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-58587 |
medium | 6.1 | 0.0026 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-58588 |
medium | 6.1 | 0.0026 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-58589 |
medium | 5.4 | 0.0023 | 2026-10-29 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issu | |
CVE-2026-58590 |
medium | 5.4 | 0.0023 | 2026-10-29 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issu | |
CVE-2026-58591 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-59155 |
medium | 6.9 | 0.0039 | 2026-10-29 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M | |
CVE-2026-11914 |
medium | 5.9 | 0.0035 | 2026-10-29 | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. | |
CVE-2026-11915 |
medium | 5.9 | 0.0031 | 2026-10-29 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute fo |