Browse All CVEs
10,438 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-53948 |
medium | 5.4 | 0.0023 | 2026-10-29 | Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient valid | |
CVE-2026-53949 |
medium | 5.3 | 0.0036 | 2026-10-29 | Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation app | |
CVE-2026-13208 |
medium | 6.5 | 0.0013 | 2026-10-29 | A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for Ha | |
CVE-2026-31978 |
medium | 6.5 | 0.0034 | 2026-10-29 | motionEye (mEye) is an online interface for motion software, which is a video surveillance | |
CVE-2026-32315 |
medium | 5.5 | 0.0168 | 2026-10-29 | motionEye (mEye) is an online interface for motion software, a video surveillance program | |
CVE-2026-47733 |
medium | 4.4 | 0.0014 | 2026-10-29 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior t | |
CVE-2026-49278 |
medium | 6.7 | 0.0041 | 2026-10-29 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior t | |
CVE-2026-10642 |
medium | 4.6 | 0.0024 | 2026-10-29 | The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software | |
CVE-2026-49979 |
medium | 5.1 | 0.0037 | 2026-10-29 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.9 | |
CVE-2026-53765 |
medium | 6.1 | 0.0010 | 2026-10-29 | Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspec | |
CVE-2026-53766 |
medium | 6.1 | 0.0012 | 2026-10-29 | Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspec | |
CVE-2026-54068 |
medium | 5.9 | 0.0432 | 2026-10-29 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/ic | |
CVE-2026-55455 |
medium | 5.3 | 0.0039 | 2026-10-29 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1 | |
CVE-2026-9774 |
medium | 6.5 | 0.0151 | 2026-10-29 | ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This | |
CVE-2026-9775 |
medium | 6.5 | 0.0151 | 2026-10-29 | ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vuln | |
CVE-2026-9153 |
medium | 6.5 | 0.0045 | 2026-10-29 | Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows auth | |
CVE-2026-9154 |
medium | 6.5 | 0.0041 | 2026-10-29 | Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows aut | |
CVE-2026-8662 |
medium | 4.3 | 0.0029 | 2026-10-29 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compr | |
CVE-2026-10086 |
medium | 5.4 | 0.0035 | 2026-10-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11. | |
CVE-2026-46751 |
medium | 5.5 | 0.0033 | 2026-10-29 | A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through | |
CVE-2026-54226 |
medium | 6.4 | 0.0040 | 2026-10-29 | A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through | |
CVE-2026-42005 |
medium | 4.3 | 0.0063 | 2026-10-29 | An attacker can send a web request that causes unlimited memory allocation in the interna | |
CVE-2026-40209 |
medium | 5.3 | 0.0070 | 2026-10-29 | An attacker might be able to cause outgoing TCP connections to backend to be stuck until a | |
CVE-2026-40210 |
medium | 4.8 | 0.0074 | 2026-10-29 | An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in | |
CVE-2026-40211 |
medium | 5.3 | 0.0070 | 2026-10-29 | An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevent | |
CVE-2026-40012 |
medium | 5.3 | 0.0045 | 2026-10-29 | ECS zero scoped answers are stored in the packet cache while they should not. This impacts | |
CVE-2026-42387 |
medium | 5.9 | 0.0048 | 2026-10-29 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that | |
CVE-2026-42388 |
medium | 5.9 | 0.0048 | 2026-10-29 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. | |
CVE-2026-42389 |
medium | 5.3 | 0.0030 | 2026-10-29 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incomi | |
CVE-2026-42390 |
medium | 5.3 | 0.0030 | 2026-10-29 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if | |
CVE-2026-52690 |
medium | 5.9 | 0.0043 | 2026-10-29 | Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting | |
CVE-2026-56013 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerc | |
CVE-2026-56023 |
medium | 5.4 | 0.0029 | 2026-10-29 | Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 ver | |
CVE-2026-56050 |
medium | 6.5 | 0.0033 | 2026-10-29 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting | |
CVE-2026-57429 |
medium | 6.5 | 0.0034 | 2026-10-29 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | |
CVE-2026-57619 |
medium | 6.5 | 0.0037 | 2026-10-29 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. | |
CVE-2026-13222 |
medium | 6.3 | 0.0033 | 2026-10-29 | Our payment integration with Oppwa-based payment methods did not properly validate paymen | |
CVE-2026-13223 |
medium | 6.3 | 0.0033 | 2026-10-29 | Our payment integration with Computop-based payment methods did not properly validate pay | |
CVE-2026-49319 |
medium | 6.9 | 0.0030 | 2026-10-29 | Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manu | |
CVE-2026-57235 |
medium | 6.3 | 0.0043 | 2026-10-29 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior t | |
CVE-2026-57536 |
medium | 6.3 | 0.0033 | 2026-10-29 | Our payment integration with Mollie did not properly validate payment status responses. A | |
CVE-2026-6432 |
medium | 5.3 | 0.0060 | 2026-10-29 | Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 throu | |
CVE-2026-48941 |
medium | 6.5 | 0.0027 | 2026-10-29 | The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parame | |
CVE-2026-48942 |
medium | 6.1 | 0.0025 | 2026-10-29 | K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via t | |
CVE-2026-48943 |
medium | 6.5 | 0.0030 | 2026-10-29 | K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A | |
CVE-2026-48944 |
medium | 6.5 | 0.0044 | 2026-10-29 | The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that | |
CVE-2026-48945 |
medium | 5.3 | 0.0033 | 2026-10-29 | The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2 | |
CVE-2026-48946 |
medium | 6.3 | 0.0028 | 2026-10-29 | The K2 frontend article-attachment upload path accepts files whose extension is `.php`, an | |
CVE-2026-4522 |
medium | 6.7 | 0.0018 | 2026-10-29 | Missing authentication for critical function vulnerability in HYPR Passwordless on Windows | |
CVE-2026-9718 |
medium | 6.9 | 0.0043 | 2026-10-29 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacke |