Browse All CVEs
13,629 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-10079 |
high | 8.5 | 0.0019 | 2026-10-29 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When process | |
CVE-2026-62391 |
high | 8.1 | 0.0079 | 2026-10-29 | The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyu | |
CVE-2026-46593 |
high | 8.6 | 0.0038 | 2026-10-29 | A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Im | |
CVE-2026-10685 |
high | 7.6 | 0.0030 | 2026-10-29 | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys | |
CVE-2026-10686 |
high | 7.5 | 0.0052 | 2026-10-29 | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the | |
CVE-2026-17346 |
high | 8.7 | 0.0062 | 2026-10-29 | The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMME | |
CVE-2026-17347 |
high | 7.7 | 0.0072 | 2026-10-29 | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator confi | |
CVE-2026-67607 |
high | 8.2 | 0.0040 | 2026-10-29 | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE | |
CVE-2026-52856 |
high | 7.5 | 0.0061 | 2026-10-29 | Wings is the server control plane for Pterodactyl, a free, open-source game server managem | |
CVE-2026-54729 |
high | 8.7 | 0.0048 | 2026-10-29 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defen | |
CVE-2026-54737 |
high | 7.3 | 0.0046 | 2026-10-29 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and n | |
CVE-2026-55100 |
high | 8.7 | 0.0056 | 2026-10-29 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to | |
CVE-2026-53510 |
high | 8.1 | 0.0069 | 2026-10-29 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpo | |
CVE-2026-53599 |
high | 7.5 | 0.0051 | 2026-10-29 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool:: | |
CVE-2026-62999 |
high | 7.5 | 0.0044 | 2026-10-29 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0 | |
CVE-2026-38710 |
high | 7.2 | 0.0233 | 2026-10-29 | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerabi | |
CVE-2026-34641 |
high | 7.8 | 0.0026 | 2026-10-29 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbi | |
CVE-2026-9044 |
high | 8.5 | 0.0251 | 2026-10-29 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers | |
CVE-2026-18536 |
high | 7.5 | 0.0020 | 2026-10-29 | Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. | |
CVE-2026-67322 |
high | 8.7 | 0.0033 | 2026-10-29 | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_f | |
CVE-2026-67323 |
high | 8.6 | 0.0125 | 2026-10-29 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arg | |
CVE-2026-67325 |
high | 8.7 | 0.0221 | 2026-10-29 | GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to a | |
CVE-2026-67326 |
high | 7.3 | 0.0025 | 2026-10-29 | GitPython before 3.1.50 fails to validate newline characters in the section parameter of c | |
CVE-2026-67328 |
high | 8.6 | 0.0049 | 2026-10-29 | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabili | |
CVE-2026-67329 |
high | 7.1 | 0.0031 | 2026-10-29 | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta. | |
CVE-2026-67331 |
high | 8.7 | 0.0039 | 2026-10-29 | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCI | |
CVE-2026-67340 |
high | 8.6 | 0.0092 | 2026-10-29 | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in | |
CVE-2026-67343 |
high | 8.7 | 0.0051 | 2026-10-29 | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/ | |
CVE-2026-67344 |
high | 8.5 | 0.0024 | 2026-10-29 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER | |
CVE-2026-55735 |
high | 8.2 | 0.0046 | 2026-10-29 | Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthent | |
CVE-2026-18556 |
high | 8.2 | 0.0788 | 2026-10-29 | KEV | N-able N-central contains an authentication bypass using an alternate path or channel that |
CVE-2026-67356 |
high | 8.7 | 0.0044 | 2026-10-29 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger context | |
CVE-2026-67357 |
high | 7.7 | 0.0042 | 2026-10-29 | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP | |
CVE-2026-68578 |
high | 7.7 | 0.0036 | 2026-10-29 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP t | |
CVE-2026-68581 |
high | 8.6 | 0.0046 | 2026-10-29 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token man | |
CVE-2026-9856 |
high | 7.1 | 0.0046 | 2026-10-29 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to pe | |
CVE-2026-10848 |
high | 8.6 | 0.0038 | 2026-10-29 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg | |
CVE-2026-18577 |
high | 8.2 | 0.1462 | 2026-10-29 | KEV | N-able N-central contains an authentication bypass using an alternate path or channel allo |
CVE-2026-3245 |
high | 7.7 | 0.0071 | 2026-10-29 | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead t | |
CVE-2026-59644 |
high | 8.7 | 0.0049 | 2026-10-29 | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generatio | |
CVE-2026-20465 |
high | 8.1 | 0.0031 | 2026-10-29 | In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. | |
CVE-2026-20479 |
high | 7.5 | 0.0071 | 2026-10-29 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could | |
CVE-2026-20483 |
high | 7.7 | 0.0017 | 2026-10-29 | In Telephony, there is a possible escalation of privilege due to a missing permission chec | |
CVE-2026-20495 |
high | 7.8 | 0.0015 | 2026-10-29 | In Bluetooth driver, there is a possible permission bypass due to a missing permission che | |
CVE-2026-12852 |
high | 8.7 | 0.0049 | 2026-10-29 | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque | |
CVE-2026-18589 |
high | 8.9 | 0.0110 | 2026-10-29 | A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function | |
CVE-2026-4793 |
high | 7.3 | 0.0015 | 2026-10-29 | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 al | |
CVE-2026-9593 |
high | 8.4 | 0.0017 | 2026-10-29 | A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to | |
CVE-2026-21548 |
high | 7.5 | 0.0071 | 2026-10-29 | In nr modem, there is a possible improper input validation. This could lead to remote deni | |
CVE-2026-21549 |
high | 7.5 | 0.0071 | 2026-10-29 | In modem, there is a possible improper input validation. This could lead to remote denial |