Browse All CVEs
10,463 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-58403 |
medium | 5.9 | 0.0047 | 2026-10-29 | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem | |
CVE-2026-58404 |
medium | 4.6 | 0.0037 | 2026-10-29 | Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http | |
CVE-2026-21368 |
medium | 5.3 | 0.0008 | 2026-10-29 | Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer | |
CVE-2026-21369 |
medium | 5.3 | 0.0008 | 2026-10-29 | Memory Corruption when handling flash commands due to outdated LED count values being used | |
CVE-2026-21370 |
medium | 5.3 | 0.0008 | 2026-10-29 | Memory Corruption when validating input batch size and buffer plane count exceeds maximum | |
CVE-2026-21384 |
medium | 5.3 | 0.0008 | 2026-10-29 | Memory Corruption when updating prepared commands with invalid port indices based on user | |
CVE-2026-48267 |
medium | 5.5 | 0.0023 | 2026-10-29 | DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnera | |
CVE-2026-50135 |
medium | 6.9 | 0.0041 | 2026-10-29 | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs | |
CVE-2026-59711 |
medium | 5.3 | 0.0023 | 2026-10-29 | showdown contains a cross-site scripting vulnerability in metadata title handling that all | |
CVE-2026-32718 |
medium | 6.5 | 0.0026 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-34050 |
medium | 6.5 | 0.0038 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-34167 |
medium | 5.0 | 0.0025 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-41899 |
medium | 6.5 | 0.0036 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-43925 |
medium | 6.9 | 0.0046 | 2026-10-29 | FOSSBilling is a free, open-source billing and client management system. Prior to version | |
CVE-2026-13356 |
medium | 6.3 | 0.0022 | 2026-10-29 | A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaSc | |
CVE-2026-34170 |
medium | 4.3 | 0.0021 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-34198 |
medium | 5.3 | 0.0017 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-42147 |
medium | 4.9 | 0.0032 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-26053 |
medium | 5.3 | 0.0025 | 2026-10-29 | An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server all | |
CVE-2026-58315 |
medium | 5.1 | 0.0015 | 2026-10-29 | Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views | |
CVE-2026-7380 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerabilit | |
CVE-2026-8306 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-8309 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-13199 |
medium | 5.1 | 0.0016 | 2026-10-29 | EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR a | |
CVE-2026-14867 |
medium | 6.8 | 0.0013 | 2026-10-29 | Credentials of built-in users are insecurely stored in the User directory of PcVue project | |
CVE-2026-48828 |
medium | 6.5 | 0.0066 | 2026-10-29 | The Bulk Variables API in Apache Airflow called the redactor without passing the variable' | |
CVE-2026-48891 |
medium | 4.3 | 0.0064 | 2026-10-29 | A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller' | |
CVE-2026-48892 |
medium | 6.5 | 0.0066 | 2026-10-29 | The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment v | |
CVE-2026-49296 |
medium | 6.5 | 0.0060 | 2026-10-29 | Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source o | |
CVE-2026-49487 |
medium | 6.5 | 0.0066 | 2026-10-29 | In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints retur | |
CVE-2026-10659 |
medium | 4.7 | 0.0013 | 2026-10-29 | The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the d | |
CVE-2026-53877 |
medium | 6.3 | 0.0053 | 2026-10-29 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib. | |
CVE-2026-53878 |
medium | 5.3 | 0.0033 | 2026-10-29 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValid | |
CVE-2026-59709 |
medium | 5.3 | 0.0034 | 2026-10-29 | Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to veri | |
CVE-2026-56812 |
medium | 6.3 | 0.0080 | 2026-10-29 | Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework pho | |
CVE-2026-48947 |
medium | 6.4 | 0.0033 | 2026-10-29 | An improper access check allows privileged users to overwrite media files without editing | |
CVE-2026-48948 |
medium | 6.4 | 0.0042 | 2026-10-29 | An improper access check allows user to download vcard exports of com_contact contacts tha | |
CVE-2026-48949 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of validation leads to an XSS vulnerability in the MFA management views. | |
CVE-2026-48950 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to an XSS vulnerability in the file management view of com_template | |
CVE-2026-48951 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components | |
CVE-2026-48952 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | |
CVE-2026-48953 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | |
CVE-2026-48954 |
medium | 5.9 | 0.0024 | 2026-10-29 | Improper validation leads to a generic XSS vector in the language override feature. | |
CVE-2026-48955 |
medium | 6.4 | 0.0034 | 2026-10-29 | An improper access check allows unauthorized users to access workflow stage and transition | |
CVE-2026-48956 |
medium | 6.4 | 0.0027 | 2026-10-29 | An improper access check allows users to display a list of modules in the frontend. | |
CVE-2026-48957 |
medium | 6.4 | 0.0042 | 2026-10-29 | An improper access check allows unauthorized users to access com_privacy datasets. | |
CVE-2026-48958 |
medium | 6.4 | 0.0046 | 2026-10-29 | An improper access check allows unauthorized users to create custom fields via webservices | |
CVE-2026-44877 |
medium | 6.5 | 0.0046 | 2026-10-29 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking I | |
CVE-2026-46672 |
medium | 4.6 | 0.0018 | 2026-10-29 | Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a han | |
CVE-2026-46700 |
medium | 4.3 | 0.0025 | 2026-10-29 | Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endp |