Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-119613 |
medium | 5.3 | 0.0027 | 2026-11-09 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project | |
CVE-2026-119610 |
high | 8.2 | 0.0072 | 2026-11-09 | A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloade | |
CVE-2026-88833 |
medium | 6.5 | 0.0019 | 2026-11-09 | A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the cl | |
CVE-2026-95648 |
high | 8.1 | 0.0024 | 2026-11-09 | Improperly controlled modification of Dynamically-Determined object attributes vulnerabili | |
CVE-2026-112169 |
medium | 6.1 | 0.0015 | 2026-11-09 | Magistra software contains undocumented backdoor functionality that allows authentication | |
CVE-2026-112168 |
medium | 6.0 | 0.0005 | 2026-11-09 | The Magistra software uses weak custom encryption, relies on an outdated compression algor | |
CVE-2026-112171 |
medium | 4.4 | 0.0010 | 2026-11-09 | An attacker can inject malicious SQL statements through user-controlled input, allowing un | |
CVE-2026-112170 |
medium | 6.3 | 0.0011 | 2026-11-09 | The software downloads upgrade files without performing integrity checks, allowing the ins | |
CVE-2026-124622 |
medium | 4.8 | 0.0010 | 2026-11-09 | A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the functio | |
CVE-2026-110469 |
critical | 10.0 | 0.0070 | 2026-11-09 | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. | |
CVE-2026-110468 |
critical | 10.0 | 0.0064 | 2026-11-09 | 1 PoC | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_phot |
CVE-2026-112205 |
medium | 6.9 | 0.0036 | 2026-11-09 | WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The | |
CVE-2026-112204 |
medium | 5.1 | 0.0044 | 2026-11-09 | WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can pr | |
CVE-2026-18942 |
medium | 5.5 | 0.0039 | 2026-11-09 | A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code int | |
CVE-2026-94434 |
high | 8.8 | 0.0128 | 2026-11-09 | 1 PoC | Improper neutralization of special elements used in an OS command ('OS command injection') |
CVE-2026-120856 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-120854 |
high | 7.5 | 0.0036 | 2026-11-09 | Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iube | |
CVE-2026-118798 |
medium | 4.4 | 0.0016 | 2026-11-09 | Multiple sensitive authentication data, including credentials, OAuth-related secrets, sess | |
CVE-2026-118795 |
medium | 5.9 | 0.0014 | 2026-11-09 | Administrative roles and module permissions are stored in mutable local database fields, a | |
CVE-2026-118792 |
medium | 6.1 | 0.0011 | 2026-11-09 | Default credentials permit access through AcuXDBC. | |
CVE-2026-118791 |
high | 7.2 | 0.0016 | 2026-11-09 | The application implements software update functionality without adequate authenticity and | |
CVE-2026-118790 |
high | 7.2 | 0.0025 | 2026-11-09 | Multiple hardcoded credentials are embedded within product components and administrative f | |
CVE-2026-124079 |
critical | 9.3 | 0.0062 | 2026-11-09 | 1 PoC | rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of |
CVE-2026-121629 |
high | 7.5 | 0.0056 | 2026-11-09 | A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When process | |
CVE-2026-112172 |
high | 8.1 | 0.0038 | 2026-11-09 | CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated att | |
CVE-2026-118459 |
medium | 6.3 | 0.0032 | 2026-11-09 | A time-derived emergency password can be derived from publicly available application code, | |
CVE-2026-118458 |
high | 8.1 | 0.0025 | 2026-11-09 | The shared AIS login routing selects a production-shipped test DAO and plaintext compariso | |
CVE-2026-118450 |
medium | 5.9 | 0.0011 | 2026-11-09 | Venere is installed outside Program Files and loads/registers unsigned components from loc | |
CVE-2026-118465 |
medium | 5.8 | 0.0010 | 2026-11-09 | Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related databa | |
CVE-2026-118464 |
medium | 5.8 | 0.0010 | 2026-11-09 | Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts | |
CVE-2026-118462 |
critical | 9.2 | 0.0017 | 2026-11-09 | Update components download and execute code without proper authenticity verification, rely | |
CVE-2026-118461 |
high | 8.0 | 0.0032 | 2026-11-09 | The shared client accepts caller-controlled doctor identifiers for read and write operatio | |
CVE-2026-118460 |
high | 8.0 | 0.0025 | 2026-11-09 | Embedded private keys protected by a shared password can be used to sign practitioner asse | |
CVE-2026-118468 |
high | 7.2 | 0.0024 | 2026-11-09 | XML parsers process attacker-influenced update manifests or network responses with externa | |
CVE-2026-118467 |
medium | 4.3 | 0.0011 | 2026-11-09 | Shared telemetry and logging components store or transmit patient and doctor identifiers, | |
CVE-2026-124684 |
medium | 5.1 | 0.0010 | 2026-11-09 | This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buf | |
CVE-2026-124621 |
low | 2.1 | 0.0027 | 2026-11-09 | A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6 | |
CVE-2026-123476 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-123475 |
high | 7.5 | 0.0032 | 2026-11-09 | Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-int | |
CVE-2026-123460 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-122666 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-122665 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-122661 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121782 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121722 |
high | 7.5 | 0.0032 | 2026-11-09 | Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Co | |
CVE-2026-121570 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-120855 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-120838 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119524 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119515 |
medium | 6.5 | 0.0021 | 2026-11-09 | Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar fo |