Browse All CVEs
10,498 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-13713 |
medium | 6.2 | 0.0018 | 2026-10-29 | YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anc | |
CVE-2026-44176 |
medium | 6.0 | 0.0036 | 2026-10-29 | Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do no | |
CVE-2026-45334 |
medium | 5.3 | 0.0036 | 2026-10-29 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, t | |
CVE-2026-58643 |
medium | 6.1 | 0.0041 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Wi | |
CVE-2026-44434 |
medium | 5.3 | 0.0021 | 2026-10-29 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O H | |
CVE-2026-62201 |
medium | 4.9 | 0.0036 | 2026-10-29 | OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the san | |
CVE-2026-62205 |
medium | 6.0 | 0.0036 | 2026-10-29 | OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnera | |
CVE-2026-62206 |
medium | 6.0 | 0.0036 | 2026-10-29 | OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord | |
CVE-2026-62212 |
medium | 5.1 | 0.0022 | 2026-10-29 | OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebindin | |
CVE-2026-62213 |
medium | 6.0 | 0.0036 | 2026-10-29 | OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbo | |
CVE-2026-62214 |
medium | 6.0 | 0.0044 | 2026-10-29 | OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vul | |
CVE-2026-62215 |
medium | 5.1 | 0.0025 | 2026-10-29 | OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP C | |
CVE-2026-62219 |
medium | 6.0 | 0.0030 | 2026-10-29 | OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the h | |
CVE-2026-62220 |
medium | 6.3 | 0.0052 | 2026-10-29 | OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to | |
CVE-2026-62226 |
medium | 5.1 | 0.0033 | 2026-10-29 | OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the b | |
CVE-2026-62227 |
medium | 4.9 | 0.0039 | 2026-10-29 | OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in | |
CVE-2026-62237 |
medium | 6.0 | 0.0030 | 2026-10-29 | Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in | |
CVE-2026-15159 |
medium | 4.3 | 0.0028 | 2026-10-29 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Objec | |
CVE-2026-15160 |
medium | 4.3 | 0.0066 | 2026-10-29 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal i | |
CVE-2026-15161 |
medium | 6.4 | 0.0026 | 2026-10-29 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scr | |
CVE-2026-21770 |
medium | 6.5 | 0.0016 | 2026-10-29 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability | |
CVE-2026-58317 |
medium | 5.1 | 0.0032 | 2026-10-29 | Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Ter | |
CVE-2026-60060 |
medium | 5.1 | 0.0032 | 2026-10-29 | Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSS | |
CVE-2026-15379 |
medium | 5.1 | 0.0015 | 2026-10-29 | The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local stand | |
CVE-2026-15380 |
medium | 5.1 | 0.0017 | 2026-10-29 | A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/ | |
CVE-2026-62764 |
medium | 5.7 | 0.0079 | 2026-10-29 | Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenti | |
CVE-2026-16013 |
medium | 5.5 | 0.0074 | 2026-10-29 | A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fd | |
CVE-2026-13082 |
medium | 5.3 | 0.0031 | 2026-10-29 | GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random | |
CVE-2026-16014 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affect | |
CVE-2026-16016 |
medium | 5.5 | 0.0050 | 2026-10-29 | A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the fu | |
CVE-2026-15007 |
medium | 5.7 | 0.0064 | 2026-10-29 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed | |
CVE-2026-15783 |
medium | 5.3 | 0.0045 | 2026-10-29 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allo | |
CVE-2026-58149 |
medium | 5.3 | 0.0034 | 2026-10-29 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joo | |
CVE-2026-63096 |
medium | 6.9 | 0.0034 | 2026-10-29 | Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows u | |
CVE-2026-63097 |
medium | 5.3 | 0.0027 | 2026-10-29 | Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi / | |
CVE-2026-63098 |
medium | 6.9 | 0.0045 | 2026-10-29 | TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability th | |
CVE-2026-9537 |
medium | 5.3 | 0.0032 | 2026-10-29 | Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time st | |
CVE-2026-21760 |
medium | 4.6 | 0.0021 | 2026-10-29 | HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Brows | |
CVE-2026-21761 |
medium | 5.4 | 0.0020 | 2026-10-29 | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Im | |
CVE-2026-21762 |
medium | 5.3 | 0.0029 | 2026-10-29 | HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may | |
CVE-2026-21764 |
medium | 4.3 | 0.0022 | 2026-10-29 | HCL DevOps Loop is affected by insufficient input validation that allows special character | |
CVE-2026-44722 |
medium | 6.2 | 0.0012 | 2026-10-29 | pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip f | |
CVE-2026-49208 |
medium | 6.9 | 0.0041 | 2026-10-29 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when | |
CVE-2026-49209 |
medium | 5.3 | 0.0056 | 2026-10-29 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfo | |
CVE-2026-49211 |
medium | 6.9 | 0.0053 | 2026-10-29 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfo | |
CVE-2026-49212 |
medium | 6.9 | 0.0024 | 2026-10-29 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the H | |
CVE-2026-49216 |
medium | 5.1 | 0.0031 | 2026-10-29 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the S | |
CVE-2026-63309 |
medium | 5.3 | 0.0033 | 2026-10-29 | SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, a | |
CVE-2026-12283 |
medium | 6.1 | 0.0059 | 2026-10-29 | Amazon Athena is a serverless, interactive query service that lets you analyze data direct | |
CVE-2026-15069 |
medium | 5.4 | 0.0030 | 2026-10-29 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute ar |