Browse All CVEs
10,515 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14645 |
medium | 5.1 | 0.0036 | 2026-10-29 | Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's | |
CVE-2026-14646 |
medium | 4.9 | 0.0035 | 2026-10-29 | Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protectio | |
CVE-2026-15429 |
medium | 5.1 | 0.0139 | 2026-10-29 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer | |
CVE-2026-15703 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. T | |
CVE-2026-45496 |
medium | 5.5 | 0.0047 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual S | |
CVE-2026-47282 |
medium | 6.5 | 0.0087 | 2026-10-29 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an un | |
CVE-2026-54432 |
medium | 4.7 | 0.0021 | 2026-10-29 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting | |
CVE-2026-56185 |
medium | 6.5 | 0.0084 | 2026-10-29 | Improper authentication in Windows Admin Center allows an authorized attacker to disclose | |
CVE-2026-58279 |
medium | 6.5 | 0.0064 | 2026-10-29 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privile | |
CVE-2026-59888 |
medium | 6.5 | 0.0042 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-15757 |
medium | 6.3 | 0.0025 | 2026-10-29 | A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the s | |
CVE-2026-47969 |
medium | 5.5 | 0.0026 | 2026-10-29 | Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure | |
CVE-2026-50657 |
medium | 4.7 | 0.0040 | 2026-10-29 | 1 PoC | Exposure of private personal information to an unauthorized actor in Microsoft Defender al |
CVE-2026-55145 |
medium | 6.3 | 0.0053 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Out | |
CVE-2026-56178 |
medium | 5.5 | 0.0023 | 2026-10-29 | Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allow | |
CVE-2026-57083 |
medium | 5.5 | 0.0054 | 2026-10-29 | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized a | |
CVE-2026-57084 |
medium | 5.5 | 0.0054 | 2026-10-29 | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to | |
CVE-2026-57973 |
medium | 6.3 | 0.0022 | 2026-10-29 | 1 PoC | Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an |
CVE-2026-62659 |
medium | 4.3 | 0.0024 | 2026-10-29 | A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone | |
CVE-2026-15712 |
medium | 5.9 | 0.0050 | 2026-10-29 | A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 t | |
CVE-2026-45073 |
medium | 6.3 | 0.0046 | 2026-10-29 | Symfony is a PHP framework for web and console applications and a set of reusable PHP comp | |
CVE-2026-47429 |
medium | 5.9 | 0.0088 | 2026-10-29 | Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API | |
CVE-2026-47481 |
medium | 6.5 | 0.0044 | 2026-10-29 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can ca | |
CVE-2026-48038 |
medium | 5.3 | 0.0052 | 2026-10-29 | joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 a | |
CVE-2026-50659 |
medium | 6.5 | 0.0074 | 2026-10-29 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform s | |
CVE-2026-15738 |
medium | 5.8 | 0.0065 | 2026-10-29 | Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Ba | |
CVE-2026-15766 |
medium | 6.5 | 0.0040 | 2026-10-29 | Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attack | |
CVE-2026-15768 |
medium | 6.5 | 0.0024 | 2026-10-29 | Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 | |
CVE-2026-15770 |
medium | 6.5 | 0.0035 | 2026-10-29 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker | |
CVE-2026-15771 |
medium | 5.3 | 0.0030 | 2026-10-29 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 1 | |
CVE-2026-15775 |
medium | 6.5 | 0.0024 | 2026-10-29 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remo | |
CVE-2026-15778 |
medium | 6.5 | 0.0030 | 2026-10-29 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7 | |
CVE-2026-24220 |
medium | 6.4 | 0.0033 | 2026-10-29 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where | |
CVE-2026-24226 |
medium | 6.3 | 0.0016 | 2026-10-29 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause impro | |
CVE-2026-24234 |
medium | 6.8 | 0.0015 | 2026-10-29 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching fu | |
CVE-2026-24259 |
medium | 6.4 | 0.0018 | 2026-10-29 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missi | |
CVE-2026-24271 |
medium | 6.2 | 0.0016 | 2026-10-29 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where | |
CVE-2026-47470 |
medium | 6.2 | 0.0016 | 2026-10-29 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API | |
CVE-2026-47475 |
medium | 6.2 | 0.0016 | 2026-10-29 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where | |
CVE-2026-47979 |
medium | 5.5 | 0.0026 | 2026-10-29 | Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclo | |
CVE-2026-48125 |
medium | 5.3 | 0.0052 | 2026-10-29 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devic | |
CVE-2026-48308 |
medium | 5.9 | 0.0024 | 2026-10-29 | Premiere Pro is affected by an Improper Input Validation vulnerability that could result i | |
CVE-2026-48338 |
medium | 6.8 | 0.0047 | 2026-10-29 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ( | |
CVE-2026-48758 |
medium | 5.4 | 0.0024 | 2026-10-29 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to | |
CVE-2026-48816 |
medium | 6.5 | 0.0014 | 2026-10-29 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to | |
CVE-2026-49458 |
medium | 6.1 | 0.0040 | 2026-10-29 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to | |
CVE-2026-49459 |
medium | 6.1 | 0.0037 | 2026-10-29 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to | |
CVE-2026-49854 |
medium | 5.3 | 0.0042 | 2026-10-29 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the | |
CVE-2026-49978 |
medium | 6.3 | 0.0040 | 2026-10-29 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to | |
CVE-2026-59889 |
medium | 6.5 | 0.0035 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo |