Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-82527 |
high | 8.7 | 0.0046 | 2026-11-08 | R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attac | |
CVE-2026-82526 |
critical | 9.3 | 0.0071 | 2026-11-08 | R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticat | |
CVE-2026-82524 |
high | 8.6 | 0.0063 | 2026-11-08 | UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authen | |
CVE-2026-82522 |
medium | 5.3 | 0.0023 | 2026-11-08 | libjxl before 0.12 contains an integer underflow vulnerability in the container box parser | |
CVE-2026-82521 |
medium | 6.3 | 0.0043 | 2026-11-08 | parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path de | |
CVE-2026-82520 |
high | 8.7 | 0.0078 | 2026-11-08 | parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read | |
CVE-2026-82451 |
medium | 5.3 | 0.0036 | 2026-11-08 | Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit track | |
CVE-2026-82026 |
high | 8.7 | 0.0092 | 2026-11-08 | Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTermi | |
CVE-2026-81029 |
high | 8.5 | 0.0055 | 2026-11-08 | OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the | |
CVE-2026-78209 |
high | 8.4 | 0.0041 | 2026-11-08 | exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell | |
CVE-2026-78208 |
high | 8.7 | 0.0051 | 2026-11-08 | exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() f | |
CVE-2026-78207 |
critical | 9.3 | 0.0060 | 2026-11-08 | exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper | |
CVE-2026-78206 |
high | 8.7 | 0.0063 | 2026-11-08 | exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory wit | |
CVE-2026-77815 |
high | 8.7 | 0.0050 | 2026-11-08 | to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, wh | |
CVE-2026-77814 |
high | 8.7 | 0.0050 | 2026-11-08 | is_path_trusted in scripts/iib/api.py compares the requested path against each allowed par | |
CVE-2026-77776 |
critical | 9.1 | 0.0061 | 2026-11-08 | Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. | |
CVE-2026-77775 |
high | 8.6 | 0.0059 | 2026-11-08 | Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-bas | |
CVE-2026-77767 |
high | 7.5 | 0.0046 | 2026-11-08 | Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that req | |
CVE-2026-77763 |
medium | 6.5 | 0.0050 | 2026-11-08 | The filestore backend in pkg/object/file.go, used for file:// stores and as a common juice | |
CVE-2026-77220 |
high | 7.1 | 0.0042 | 2026-11-08 | PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-form | |
CVE-2026-77219 |
medium | 6.9 | 0.0013 | 2026-11-08 | GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that | |
CVE-2026-76876 |
high | 8.2 | 0.0044 | 2026-11-08 | Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthen | |
CVE-2026-76875 |
medium | 6.3 | 0.0024 | 2026-11-08 | PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the py | |
CVE-2026-76840 |
high | 8.5 | 0.0043 | 2026-11-08 | RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size c | |
CVE-2026-75149 |
high | 8.7 | 0.0096 | 2026-11-08 | marimo before 0.23.15 contains a code injection vulnerability in the notebook configuratio | |
CVE-2026-75140 |
high | 8.7 | 0.0053 | 2026-11-08 | jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumpti | |
CVE-2026-73683 |
high | 8.1 | 0.0076 | 2026-11-08 | Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that | |
CVE-2026-73678 |
critical | 10.0 | 0.0159 | 2026-11-08 | 1 PoC | MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code |
CVE-2026-73524 |
medium | 5.1 | 0.0041 | 2026-11-08 | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module t | |
CVE-2026-73514 |
high | 8.7 | 0.0082 | 2026-11-08 | The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, con | |
CVE-2026-73036 |
medium | 4.6 | 0.0018 | 2026-11-08 | Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk th | |
CVE-2026-72860 |
high | 8.5 | 0.0038 | 2026-11-08 | The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and | |
CVE-2026-72001 |
high | 8.6 | 0.0049 | 2026-11-08 | 1 PoC | Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthe |
CVE-2026-71981 |
high | 8.7 | 0.0097 | 2026-11-08 | 1 PoC | Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticate |
CVE-2026-71963 |
high | 8.6 | 0.0086 | 2026-11-08 | 1 PoC | Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execut |
CVE-2026-68772 |
high | 8.5 | 0.0076 | 2026-11-08 | ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer | |
CVE-2026-67194 |
high | 7.1 | 0.0055 | 2026-11-08 | Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP us | |
CVE-2026-66412 |
high | 7.1 | 0.0042 | 2026-11-08 | Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authen | |
CVE-2026-65054 |
high | 8.2 | 0.0032 | 2026-11-08 | MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated | |
CVE-2026-64826 |
high | 7.1 | 0.0048 | 2026-11-08 | rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated at | |
CVE-2026-63769 |
medium | 6.3 | 0.0042 | 2026-11-08 | Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch | |
CVE-2026-63094 |
high | 7.6 | 0.0026 | 2026-11-08 | SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication fl | |
CVE-2026-63089 |
critical | 9.0 | 0.0041 | 2026-11-08 | WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak | |
CVE-2026-61519 |
high | 8.7 | 0.0038 | 2026-11-08 | Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows | |
CVE-2026-5857 |
high | 8.1 | 0.0092 | 2026-11-08 | Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_l | |
CVE-2026-5856 |
high | 7.1 | 0.0029 | 2026-11-08 | Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-f | |
CVE-2026-5855 |
high | 7.5 | 0.0072 | 2026-11-08 | Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores it | |
CVE-2026-59704 |
high | 7.1 | 0.0027 | 2026-11-08 | Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before ret | |
CVE-2026-59100 |
medium | 5.0 | 0.0029 | 2026-11-08 | LobeChat through 2.2.9 contains a broken object level authorization vulnerability that all | |
CVE-2026-59095 |
high | 7.7 | 0.0040 | 2026-11-08 | LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that |