Browse All CVEs
10,519 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49971 |
medium | 5.3 | 0.0036 | 2026-10-29 | Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that al | |
CVE-2026-58228 |
medium | 5.1 | 0.0047 | 2026-10-29 | Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacke | |
CVE-2026-58408 |
medium | 6.5 | 0.0036 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privil | |
CVE-2026-15597 |
medium | 5.5 | 0.0043 | 2026-10-29 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1. | |
CVE-2026-15598 |
medium | 5.3 | 0.0042 | 2026-10-29 | A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedVa | |
CVE-2026-56877 |
medium | 6.3 | 0.0039 | 2026-10-29 | The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does n | |
CVE-2026-62198 |
medium | 5.3 | 0.0027 | 2026-10-29 | OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability | |
CVE-2026-62239 |
medium | 5.3 | 0.0016 | 2026-10-29 | FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vul | |
CVE-2026-15621 |
medium | 4.8 | 0.0020 | 2026-10-29 | A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function re | |
CVE-2026-44759 |
medium | 6.1 | 0.0029 | 2026-10-29 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scr | |
CVE-2026-44760 |
medium | 4.7 | 0.0023 | 2026-10-29 | Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server P | |
CVE-2026-44767 |
medium | 6.1 | 0.0029 | 2026-10-29 | setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-cont | |
CVE-2026-44768 |
medium | 4.1 | 0.0026 | 2026-10-29 | SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the con | |
CVE-2026-44769 |
medium | 5.5 | 0.0031 | 2026-10-29 | SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileg | |
CVE-2026-44770 |
medium | 4.3 | 0.0028 | 2026-10-29 | SAP Create Single Payment does not perform necessary authorization checks for an authentic | |
CVE-2026-44771 |
medium | 4.3 | 0.0028 | 2026-10-29 | SAP S/4HANA Draft operation does not perform necessary authorization checks for an authent | |
CVE-2026-15622 |
medium | 5.5 | 0.0059 | 2026-10-29 | A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_works | |
CVE-2026-12482 |
medium | 6.5 | 0.0033 | 2026-10-29 | A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious | |
CVE-2026-15675 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was identified in code-projects Online Job Portal 1.0. The affected elemen | |
CVE-2026-15676 |
medium | 5.5 | 0.0043 | 2026-10-29 | A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impa | |
CVE-2026-15677 |
medium | 5.5 | 0.0050 | 2026-10-29 | A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unk | |
CVE-2026-10051 |
medium | 6.9 | 0.0043 | 2026-10-29 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the t | |
CVE-2026-12606 |
medium | 6.3 | 0.0030 | 2026-10-29 | Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in mal | |
CVE-2026-13699 |
medium | 6.5 | 0.0039 | 2026-10-29 | In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler | |
CVE-2026-59246 |
medium | 6.3 | 0.0050 | 2026-10-29 | Allocation of resources without limits vulnerability in elixir-mint mint allows a remote H | |
CVE-2026-6790 |
medium | 5.3 | 0.0031 | 2026-10-29 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that th | |
CVE-2026-8384 |
medium | 5.3 | 0.0033 | 2026-10-29 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt resu | |
CVE-2026-12478 |
medium | 4.8 | 0.0024 | 2026-10-29 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guar | |
CVE-2026-14852 |
medium | 5.2 | 0.0018 | 2026-10-29 | Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3. | |
CVE-2026-3014 |
medium | 6.4 | 0.0078 | 2026-10-29 | Milestone has released a new version of XProtect® (and several cumulative patch updates) w | |
CVE-2026-54429 |
medium | 6.0 | 0.0027 | 2026-10-29 | A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected | |
CVE-2026-12588 |
medium | 6.0 | 0.0033 | 2026-10-29 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted | |
CVE-2026-15305 |
medium | 6.3 | 0.0025 | 2026-10-29 | Users were able to upload files with arbitrary MIME types to forms using FileUpload or Ima | |
CVE-2026-49488 |
medium | 6.5 | 0.0070 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-62393 |
medium | 4.3 | 0.0045 | 2026-10-29 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. | |
CVE-2026-53566 |
medium | 6.8 | 0.0018 | 2026-10-29 | Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This | |
CVE-2026-10573 |
medium | 6.3 | 0.0033 | 2026-10-29 | A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue st | |
CVE-2026-10670 |
medium | 5.5 | 0.0015 | 2026-10-29 | The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy | |
CVE-2026-14902 |
medium | 6.1 | 0.0071 | 2026-10-29 | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticat | |
CVE-2026-14903 |
medium | 6.5 | 0.0118 | 2026-10-29 | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated | |
CVE-2026-52837 |
medium | 6.9 | 0.0046 | 2026-10-29 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including | |
CVE-2026-58475 |
medium | 5.3 | 0.0031 | 2026-10-29 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site | |
CVE-2026-58478 |
medium | 6.3 | 0.0038 | 2026-10-29 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side reques | |
CVE-2026-11944 |
medium | 5.3 | 0.0048 | 2026-10-29 | openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy m | |
CVE-2026-23573 |
medium | 6.1 | 0.0039 | 2026-10-29 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vu | |
CVE-2026-59837 |
medium | 6.6 | 0.0067 | 2026-10-29 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, Forti | |
CVE-2026-59839 |
medium | 5.5 | 0.0025 | 2026-10-29 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerabi | |
CVE-2026-59840 |
medium | 4.3 | 0.0031 | 2026-10-29 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 th | |
CVE-2026-60118 |
medium | 6.9 | 0.0030 | 2026-10-29 | Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerabilit | |
CVE-2026-60119 |
medium | 5.1 | 0.0030 | 2026-10-29 | Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenti |