Browse All CVEs
10,500 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56349 |
medium | 6.3 | 0.0047 | 2026-10-29 | n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node | |
CVE-2026-56353 |
medium | 6.3 | 0.0033 | 2026-10-29 | n8n contains an authentication bypass in the Chat Trigger node when configured with n8n Us | |
CVE-2026-56375 |
medium | 4.8 | 0.0015 | 2026-10-29 | ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when | |
CVE-2026-56764 |
medium | 6.3 | 0.0030 | 2026-10-29 | Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth | |
CVE-2026-59236 |
medium | 6.9 | 0.0064 | 2026-10-29 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (C | |
CVE-2026-59254 |
medium | 6.3 | 0.0036 | 2026-10-29 | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets | |
CVE-2026-59259 |
medium | 6.0 | 0.0044 | 2026-10-29 | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerabilit | |
CVE-2026-60087 |
medium | 6.9 | 0.0034 | 2026-10-29 | PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attacke | |
CVE-2026-61427 |
medium | 6.9 | 0.0043 | 2026-10-29 | PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by de | |
CVE-2026-61452 |
medium | 6.9 | 0.0024 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session in | |
CVE-2026-61457 |
medium | 5.3 | 0.0061 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extensio | |
CVE-2026-46459 |
medium | 5.3 | 0.0043 | 2026-10-29 | ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device rec | |
CVE-2026-58549 |
medium | 4.0 | 0.0013 | 2026-10-29 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitatio | |
CVE-2026-58550 |
medium | 4.0 | 0.0013 | 2026-10-29 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitatio | |
CVE-2026-58551 |
medium | 5.1 | 0.0013 | 2026-10-29 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitatio | |
CVE-2026-58552 |
medium | 5.1 | 0.0013 | 2026-10-29 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitatio | |
CVE-2026-58553 |
medium | 4.0 | 0.0013 | 2026-10-29 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitatio | |
CVE-2026-58555 |
medium | 6.6 | 0.0011 | 2026-10-29 | Permission bypass vulnerability in the card module. Impact: Successful exploitation of thi | |
CVE-2026-58557 |
medium | 4.8 | 0.0010 | 2026-10-29 | Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vu | |
CVE-2026-59838 |
medium | 4.8 | 0.0024 | 2026-10-29 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerabil | |
CVE-2026-33213 |
medium | 6.1 | 0.0031 | 2026-10-29 | Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next | |
CVE-2026-60065 |
medium | 6.3 | 0.0045 | 2026-10-29 | When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter | |
CVE-2026-61646 |
medium | 6.3 | 0.0036 | 2026-10-29 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's sha | |
CVE-2026-62294 |
medium | 5.1 | 0.0014 | 2026-10-29 | Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open Wit | |
CVE-2026-41580 |
medium | 6.1 | 0.0027 | 2026-10-29 | Stirling-PDF is a locally hosted web application that facilitates various operations on PD | |
CVE-2026-45150 |
medium | 6.3 | 0.0031 | 2026-10-29 | Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persisten | |
CVE-2026-47159 |
medium | 6.9 | 0.0047 | 2026-10-29 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden | |
CVE-2026-47160 |
medium | 5.8 | 0.0029 | 2026-10-29 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden | |
CVE-2026-9007 |
medium | 5.5 | 0.0044 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-1562 |
medium | 4.6 | 0.0024 | 2026-10-29 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting | |
CVE-2026-1563 |
medium | 4.8 | 0.0024 | 2026-10-29 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site script | |
CVE-2026-47703 |
medium | 6.3 | 0.0014 | 2026-10-29 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, | |
CVE-2026-14961 |
medium | 6.2 | 0.0016 | 2026-10-29 | Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to p | |
CVE-2026-56087 |
medium | 6.1 | 0.0021 | 2026-10-29 | Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vuln | |
CVE-2026-61643 |
medium | 5.9 | 0.0019 | 2026-10-29 | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an | |
CVE-2026-15746 |
medium | 6.9 | 0.0042 | 2026-10-29 | Strands Agents is an open-source Python SDK for building and running AI agents. The strand | |
CVE-2026-26032 |
medium | 5.4 | 0.0051 | 2026-10-29 | The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package | |
CVE-2026-49988 |
medium | 6.8 | 0.0018 | 2026-10-29 | Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Rep | |
CVE-2026-54443 |
medium | 5.9 | 0.0029 | 2026-10-29 | Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget | |
CVE-2026-62348 |
medium | 5.4 | 0.0025 | 2026-10-29 | TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4. | |
CVE-2026-62353 |
medium | 5.4 | 0.0037 | 2026-10-29 | TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4. | |
CVE-2026-62355 |
medium | 5.4 | 0.0023 | 2026-10-29 | TDengine is an open source, time-series database optimized for Internet of Things devices. | |
CVE-2026-40953 |
medium | 6.7 | 0.0010 | 2026-10-29 | CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access cli | |
CVE-2026-40957 |
medium | 6.1 | 0.0043 | 2026-10-29 | o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login | |
CVE-2026-45737 |
medium | 6.5 | 0.0052 | 2026-10-29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until | |
CVE-2026-33444 |
medium | 6.9 | 0.0035 | 2026-10-29 | CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.5 | |
CVE-2026-33684 |
medium | 5.3 | 0.0024 | 2026-10-29 | WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation | |
CVE-2026-55398 |
medium | 6.9 | 0.0035 | 2026-10-29 | CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers p | |
CVE-2026-55399 |
medium | 5.1 | 0.0037 | 2026-10-29 | CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior | |
CVE-2026-55608 |
medium | 5.4 | 0.0028 | 2026-10-29 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, pro |