Browse All CVEs
13,618 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-18599 |
high | 7.3 | 0.0444 | 2026-10-29 | A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the functi | |
CVE-2026-18089 |
high | 7.5 | 0.0023 | 2026-10-29 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying res | |
CVE-2026-18092 |
high | 8.1 | 0.0034 | 2026-10-29 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signatur | |
CVE-2026-18600 |
high | 7.4 | 0.0321 | 2026-10-29 | A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function | |
CVE-2026-18601 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn | |
CVE-2026-18642 |
high | 7.8 | 0.0037 | 2026-10-29 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Re | |
CVE-2026-67608 |
high | 8.6 | 0.0243 | 2026-10-29 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, | |
CVE-2026-69086 |
high | 8.3 | 0.0053 | 2026-10-29 | SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in | |
CVE-2026-69087 |
high | 7.1 | 0.0037 | 2026-10-29 | The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vu | |
CVE-2026-69088 |
high | 8.6 | 0.0029 | 2026-10-29 | Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method call | |
CVE-2026-69089 |
high | 8.7 | 0.0046 | 2026-10-29 | Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which | |
CVE-2026-69095 |
high | 8.7 | 0.0093 | 2026-10-29 | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a pa | |
CVE-2026-69096 |
high | 8.7 | 0.0327 | 2026-10-29 | OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode d | |
CVE-2026-69097 |
high | 7.3 | 0.0027 | 2026-10-29 | GitPython before 3.1.53 fails to properly escape section names in git config files, allowi | |
CVE-2026-18568 |
high | 7.5 | 0.0032 | 2026-10-29 | XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass becau | |
CVE-2026-18602 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function | |
CVE-2026-18606 |
high | 7.1 | 0.0016 | 2026-10-29 | A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulner | |
CVE-2026-18718 |
high | 7.1 | 0.0017 | 2026-10-29 | Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer | |
CVE-2026-41453 |
high | 8.7 | 0.0050 | 2026-10-29 | Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid | |
CVE-2026-61372 |
high | 7.5 | 0.0081 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-69152 |
high | 7.5 | 0.0065 | 2026-10-29 | The brace-expansion library generates arbitrary strings containing a common prefix and suf | |
CVE-2026-18612 |
high | 8.9 | 0.0397 | 2026-10-29 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the fun | |
CVE-2026-18613 |
high | 8.9 | 0.0100 | 2026-10-29 | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the fu | |
CVE-2026-40717 |
high | 7.8 | 0.0016 | 2026-10-29 | Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Acc | |
CVE-2026-61523 |
high | 8.6 | 0.0119 | 2026-10-29 | WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets ed | |
CVE-2026-61524 |
high | 8.6 | 0.0103 | 2026-10-29 | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the | |
CVE-2026-18614 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.e | |
CVE-2026-18615 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is t | |
CVE-2026-18616 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is t | |
CVE-2026-59912 |
high | 7.8 | 0.0015 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an I | |
CVE-2026-59913 |
high | 7.8 | 0.0017 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Mi | |
CVE-2026-18655 |
high | 7.1 | 0.0042 | 2026-10-29 | Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the | |
CVE-2026-47211 |
high | 8.4 | 0.0019 | 2026-10-29 | Ouroboros is a local-first runtime for AI coding agents that records their actions and app | |
CVE-2026-62354 |
high | 7.7 | 0.0045 | 2026-10-29 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 thr | |
CVE-2026-67599 |
high | 8.6 | 0.0243 | 2026-10-29 | ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component tha | |
CVE-2026-68981 |
high | 8.8 | 0.0074 | 2026-10-29 | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application RE | |
CVE-2026-69185 |
high | 7.5 | 0.0063 | 2026-10-29 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to | |
CVE-2026-69192 |
high | 7.7 | 0.0046 | 2026-10-29 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | |
CVE-2026-18733 |
high | 7.5 | 0.0057 | 2026-10-29 | A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0 | |
CVE-2026-18737 |
high | 7.1 | 0.0040 | 2026-10-29 | Shlink contains a blind SQL injection vulnerability that allows any authenticated API key | |
CVE-2026-41447 |
high | 8.5 | 0.0017 | 2026-10-29 | FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows lo | |
CVE-2026-48113 |
high | 8.5 | 0.0039 | 2026-10-29 | Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior t | |
CVE-2026-52521 |
high | 8.1 | 0.0040 | 2026-10-29 | A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute | |
CVE-2026-66065 |
high | 8.4 | 0.0024 | 2026-10-29 | Ouroboros is a local-first runtime for AI coding agents that records their actions and app | |
CVE-2026-69244 |
high | 7.1 | 0.0053 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-10849 |
high | 7.5 | 0.0051 | 2026-10-29 | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTT | |
CVE-2026-47746 |
high | 8.9 | 0.0028 | 2026-10-29 | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, bu | |
CVE-2026-67973 |
high | 7.5 | 0.0034 | 2026-10-29 | An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of | |
CVE-2026-69247 |
high | 8.2 | 0.0027 | 2026-10-29 | cryptography is a package designed to expose cryptographic primitives and recipes to Pytho | |
CVE-2026-69249 |
high | 8.7 | 0.0026 | 2026-10-29 | python-cryptography is a package designed to expose cryptographic primitives and recipes t |