Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42479 |
medium | 5.5 | 0.0010 | 2026-11-08 | An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser | |
CVE-2026-42477 |
high | 7.1 | 0.0010 | 2026-11-08 | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser | |
CVE-2026-36959 |
high | 7.5 | 0.0035 | 2026-11-08 | 1 PoC | U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections |
CVE-2026-36958 |
high | 7.5 | 0.0032 | 2026-11-08 | 1 PoC | A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By se |
CVE-2026-36957 |
high | 7.5 | 0.0032 | 2026-11-08 | 1 PoC | Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Servic |
CVE-2024-41786 |
medium | 5.3 | 0.0040 | 2026-11-08 | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attac | |
CVE-2026-110652 |
medium | 6.3 | 0.0040 | 2026-11-08 | ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request fo | |
CVE-2026-10143 |
high | 7.5 | 0.0052 | 2026-11-08 | kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentica | |
CVE-2026-10142 |
high | 7.5 | 0.0035 | 2026-11-08 | kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol par | |
CVE-2026-10108 |
high | 7.5 | 0.0065 | 2026-11-08 | xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /musi | |
CVE-2026-10107 |
high | 7.7 | 0.0025 | 2026-11-08 | MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endp | |
CVE-2026-10105 |
high | 8.3 | 0.0040 | 2026-11-08 | agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backen | |
CVE-2026-10099 |
medium | 4.0 | 0.0013 | 2026-11-08 | XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_w | |
CVE-2026-10044 |
high | 7.5 | 0.0060 | 2026-11-08 | Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability | |
CVE-2026-10042 |
critical | 9.8 | 0.0062 | 2026-11-08 | manga-image-translator contains a remote code execution vulnerability in the shared API se | |
CVE-2026-109429 |
high | 8.7 | 0.0056 | 2026-11-08 | Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that al | |
CVE-2026-104905 |
medium | 6.1 | 0.0051 | 2026-11-08 | 1 PoC | FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in Widg |
CVE-2026-104356 |
high | 8.2 | 0.0038 | 2026-11-08 | 1 PoC | PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRando |
CVE-2026-104081 |
high | 7.2 | 0.0077 | 2026-11-08 | KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() fu | |
CVE-2026-104051 |
high | 8.8 | 0.0048 | 2026-11-08 | 1 PoC | PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauth |
CVE-2026-102639 |
high | 7.1 | 0.0032 | 2026-11-08 | MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the M | |
CVE-2026-102253 |
high | 8.7 | 0.0043 | 2026-11-08 | 1 PoC | iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unaut |
CVE-2026-101878 |
high | 7.7 | 0.0026 | 2026-11-08 | Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_R | |
CVE-2025-9611 |
high | 7.2 | 0.0122 | 2026-11-08 | Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin head | |
CVE-2025-71385 |
medium | 6.1 | 0.0043 | 2026-11-08 | Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.s | |
CVE-2025-71382 |
high | 7.1 | 0.0058 | 2026-11-08 | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS r | |
CVE-2025-71379 |
medium | 5.3 | 0.0048 | 2026-11-08 | vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service ( | |
CVE-2025-71378 |
high | 7.6 | 0.0048 | 2026-11-08 | picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file red | |
CVE-2025-71357 |
high | 7.6 | 0.0039 | 2026-11-08 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.Modi | |
CVE-2025-71351 |
high | 7.6 | 0.0055 | 2026-11-08 | picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() i | |
CVE-2025-71348 |
high | 7.6 | 0.0055 | 2026-11-08 | picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._c | |
CVE-2025-71331 |
medium | 5.1 | 0.0032 | 2026-11-08 | Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insuffi | |
CVE-2025-71330 |
high | 8.7 | 0.0043 | 2026-11-08 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote att | |
CVE-2025-71329 |
high | 8.7 | 0.0043 | 2026-11-08 | 1 PoC | image-size through 2.0.2 contains a denial of service vulnerability that allows remote att |
CVE-2025-71325 |
critical | 9.3 | 0.0060 | 2026-11-08 | picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when | |
CVE-2025-71323 |
critical | 9.3 | 0.0099 | 2026-11-08 | picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve r | |
CVE-2025-71322 |
high | 8.7 | 0.0038 | 2026-11-08 | PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals lis | |
CVE-2025-71321 |
critical | 9.3 | 0.0082 | 2026-11-08 | picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows atta | |
CVE-2025-71320 |
critical | 9.3 | 0.0082 | 2026-11-08 | picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate | |
CVE-2025-71319 |
high | 8.7 | 0.0073 | 2026-11-08 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote att | |
CVE-2025-34504 |
medium | 5.3 | 0.0034 | 2026-11-08 | KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allow | |
CVE-2025-34469 |
medium | 6.9 | 0.0067 | 2026-11-08 | Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability | |
CVE-2025-34468 |
high | 8.2 | 0.0075 | 2026-11-08 | libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based | |
CVE-2025-34267 |
high | 8.4 | 0.0688 | 2026-11-08 | Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an | |
CVE-2025-34226 |
high | 7.1 | 0.0068 | 2026-11-08 | 1 PoC | OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoin |
CVE-2025-34161 |
critical | 9.4 | 0.0296 | 2026-11-08 | 1 PoC | Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vuln |
CVE-2025-34159 |
critical | 9.4 | 0.0097 | 2026-11-08 | 1 PoC | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vuln |
CVE-2025-34157 |
critical | 9.4 | 0.0048 | 2026-11-08 | 1 PoC | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scriptin |
CVE-2025-34087 |
critical | 9.0 | 0.0704 | 2026-11-08 | An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. Whe | |
CVE-2025-34086 |
high | 7.5 | 0.0432 | 2026-11-08 | Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow |