Browse All CVEs
10,437 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54025 |
medium | 5.4 | 0.0024 | 2026-10-29 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4 | |
CVE-2026-54027 |
medium | 6.5 | 0.0032 | 2026-10-29 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4 | |
CVE-2026-54029 |
medium | 6.5 | 0.0027 | 2026-10-29 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4 | |
CVE-2026-54033 |
medium | 6.5 | 0.0035 | 2026-10-29 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4 | |
CVE-2026-54037 |
medium | 6.5 | 0.0051 | 2026-10-29 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4 | |
CVE-2026-54448 |
medium | 6.9 | 0.0044 | 2026-10-29 | Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz) | |
CVE-2026-55439 |
medium | 5.5 | 0.0041 | 2026-10-29 | Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerabil | |
CVE-2026-47770 |
medium | 6.8 | 0.0015 | 2026-10-29 | jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nes | |
CVE-2026-54679 |
medium | 6.9 | 0.0015 | 2026-10-29 | jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append ha | |
CVE-2026-28898 |
medium | 5.3 | 0.0031 | 2026-10-29 | swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for contr | |
CVE-2026-46611 |
medium | 5.3 | 0.0014 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glanc | |
CVE-2026-54250 |
medium | 5.8 | 0.0017 | 2026-10-29 | K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, | |
CVE-2026-56769 |
medium | 6.3 | 0.0037 | 2026-10-29 | Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-si | |
CVE-2026-56771 |
medium | 6.3 | 0.0035 | 2026-10-29 | NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the | |
CVE-2026-56772 |
medium | 5.3 | 0.0033 | 2026-10-29 | NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenti | |
CVE-2026-56779 |
medium | 5.3 | 0.0029 | 2026-10-29 | MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation | |
CVE-2026-56787 |
medium | 6.9 | 0.0056 | 2026-10-29 | RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode | |
CVE-2026-56788 |
medium | 4.8 | 0.0017 | 2026-10-29 | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function w | |
CVE-2026-2299 |
medium | 4.3 | 0.0020 | 2026-10-29 | The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membersh | |
CVE-2026-57521 |
medium | 5.3 | 0.0043 | 2026-10-29 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allow | |
CVE-2026-13282 |
medium | 6.8 | 0.0015 | 2026-10-29 | Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a l | |
CVE-2026-44622 |
medium | 6.9 | 0.0042 | 2026-10-29 | Charging station authentication identifiers are publicly accessible via web-based mapping | |
CVE-2026-54479 |
medium | 6.9 | 0.0042 | 2026-10-29 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but | |
CVE-2026-12993 |
medium | 6.5 | 0.0052 | 2026-10-29 | A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks extern | |
CVE-2026-13083 |
medium | 6.9 | 0.0030 | 2026-10-29 | A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into | |
CVE-2026-13218 |
medium | 4.2 | 0.0014 | 2026-10-29 | A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile | |
CVE-2026-13318 |
medium | 6.4 | 0.0024 | 2026-10-29 | A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward ha | |
CVE-2026-48618 |
medium | 6.5 | 0.0314 | 2026-10-29 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling c | |
CVE-2026-48928 |
medium | 5.4 | 0.0022 | 2026-10-29 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-cont | |
CVE-2026-48934 |
medium | 4.3 | 0.0026 | 2026-10-29 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification vali | |
CVE-2026-50739 |
medium | 4.3 | 0.0049 | 2026-10-29 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been appl | |
CVE-2026-50740 |
medium | 5.4 | 0.0038 | 2026-10-29 | A missing sanitisation vulnerability of user input in the zone-include.php script exists i | |
CVE-2026-50742 |
medium | 5.4 | 0.0034 | 2026-10-29 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-ba | |
CVE-2026-50744 |
medium | 4.3 | 0.0029 | 2026-10-29 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The AP | |
CVE-2026-50745 |
medium | 6.1 | 0.0038 | 2026-10-29 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. | |
CVE-2026-8661 |
medium | 4.8 | 0.0038 | 2026-10-29 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdow | |
CVE-2026-6658 |
medium | 5.4 | 0.0016 | 2026-10-29 | A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (X | |
CVE-2026-57473 |
medium | 5.8 | 0.0023 | 2026-10-29 | A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions | |
CVE-2026-57620 |
medium | 6.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57914 |
medium | 6.5 | 0.0044 | 2026-10-29 | By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possib | |
CVE-2026-13426 |
medium | 5.4 | 0.0029 | 2026-10-29 | The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 | |
CVE-2026-57922 |
medium | 5.3 | 0.0024 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was poss | |
CVE-2026-57924 |
medium | 5.3 | 0.0027 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive use | |
CVE-2026-57925 |
medium | 5.3 | 0.0027 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved qu | |
CVE-2026-24547 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. | |
CVE-2026-52701 |
medium | 6.5 | 0.0027 | 2026-10-29 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. | |
CVE-2026-56026 |
medium | 6.4 | 0.0023 | 2026-10-29 | Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions. | |
CVE-2026-56046 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions. | |
CVE-2026-56048 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and | |
CVE-2026-56066 |
medium | 5.8 | 0.0047 | 2026-10-29 | Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions. |