Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59093 |
high | 8.8 | 0.0071 | 2026-11-08 | Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment | |
CVE-2026-58658 |
high | 8.8 | 0.0053 | 2026-11-08 | GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information d | |
CVE-2026-58578 |
medium | 6.5 | 0.0055 | 2026-11-08 | LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ( | |
CVE-2026-58468 |
medium | 5.1 | 0.0034 | 2026-11-08 | NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the server | |
CVE-2026-58446 |
medium | 6.5 | 0.0070 | 2026-11-08 | Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments confi | |
CVE-2026-58377 |
high | 8.1 | 0.0036 | 2026-11-08 | JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authent | |
CVE-2026-58376 |
high | 7.6 | 0.0036 | 2026-11-08 | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability t | |
CVE-2026-58372 |
high | 8.1 | 0.0087 | 2026-11-08 | SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMult | |
CVE-2026-58371 |
low | 3.1 | 0.0033 | 2026-11-08 | SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served | |
CVE-2026-57957 |
low | 2.3 | 0.0044 | 2026-11-08 | Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration | |
CVE-2026-57956 |
medium | 6.1 | 0.0035 | 2026-11-08 | SigNoz before 0.133.0 contains a broken access control vulnerability that allows authentic | |
CVE-2026-57945 |
medium | 5.3 | 0.0032 | 2026-11-08 | PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that all | |
CVE-2026-57943 |
medium | 6.0 | 0.0034 | 2026-11-08 | LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the | |
CVE-2026-57850 |
high | 8.7 | 0.0050 | 2026-11-08 | 1 PoC | RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the serv |
CVE-2026-56780 |
high | 7.7 | 0.0046 | 2026-11-08 | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT | |
CVE-2026-56774 |
medium | 5.3 | 0.0048 | 2026-11-08 | Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails | |
CVE-2026-56397 |
critical | 9.4 | 0.0050 | 2026-11-08 | SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar m | |
CVE-2026-56396 |
high | 8.7 | 0.0044 | 2026-11-08 | phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and upd | |
CVE-2026-56367 |
medium | 6.3 | 0.0024 | 2026-11-08 | ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the | |
CVE-2026-56346 |
medium | 6.9 | 0.0062 | 2026-11-08 | AVideo through version 25.0 contains an authentication bypass vulnerability in the decrypt | |
CVE-2026-56345 |
critical | 9.2 | 0.0045 | 2026-11-08 | AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's up | |
CVE-2026-56342 |
medium | 6.1 | 0.0039 | 2026-11-08 | AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin | |
CVE-2026-56341 |
high | 8.7 | 0.0046 | 2026-11-08 | AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in p | |
CVE-2026-56332 |
medium | 5.1 | 0.0022 | 2026-11-08 | Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoi | |
CVE-2026-56330 |
medium | 4.8 | 0.0025 | 2026-11-08 | Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_ | |
CVE-2026-56325 |
low | 2.3 | 0.0034 | 2026-11-08 | Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id loo | |
CVE-2026-56319 |
medium | 5.3 | 0.0031 | 2026-11-08 | Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statist | |
CVE-2026-56317 |
low | 2.3 | 0.0034 | 2026-11-08 | Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulne | |
CVE-2026-56304 |
medium | 6.9 | 0.0044 | 2026-11-08 | picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing u | |
CVE-2026-56299 |
medium | 6.9 | 0.0068 | 2026-11-08 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload | |
CVE-2026-56295 |
medium | 5.3 | 0.0031 | 2026-11-08 | Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management | |
CVE-2026-56294 |
medium | 4.3 | 0.0024 | 2026-11-08 | capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability | |
CVE-2026-56282 |
medium | 6.9 | 0.0040 | 2026-11-08 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthentica | |
CVE-2026-56276 |
medium | 6.0 | 0.0037 | 2026-11-08 | Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endp | |
CVE-2026-56267 |
medium | 6.9 | 0.0046 | 2026-11-08 | Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/a | |
CVE-2026-56265 |
critical | 9.3 | 0.0264 | 2026-11-08 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded d | |
CVE-2026-56264 |
critical | 9.2 | 0.0049 | 2026-11-08 | Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Dock | |
CVE-2026-56263 |
medium | 5.3 | 0.0034 | 2026-11-08 | Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor | |
CVE-2026-56262 |
medium | 6.9 | 0.0076 | 2026-11-08 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor route | |
CVE-2026-56260 |
high | 8.8 | 0.0065 | 2026-11-08 | Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API ser | |
CVE-2026-56253 |
high | 8.7 | 0.0042 | 2026-11-08 | Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_ | |
CVE-2026-56251 |
high | 7.0 | 0.0044 | 2026-11-08 | Capgo before 12.128.2 contains a broken row level security policy in the org_users table t | |
CVE-2026-56242 |
high | 8.7 | 0.0044 | 2026-11-08 | Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identi | |
CVE-2026-56239 |
high | 7.2 | 0.0035 | 2026-11-08 | Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the publi | |
CVE-2026-56229 |
high | 7.1 | 0.0037 | 2026-11-08 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status | |
CVE-2026-56228 |
medium | 6.9 | 0.0047 | 2026-11-08 | Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length fiel | |
CVE-2026-56227 |
medium | 5.3 | 0.0026 | 2026-11-08 | Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL | |
CVE-2026-56218 |
medium | 6.9 | 0.0034 | 2026-11-08 | Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from upl | |
CVE-2026-56216 |
high | 8.7 | 0.0044 | 2026-11-08 | Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/ | |
CVE-2026-56215 |
high | 8.7 | 0.0039 | 2026-11-08 | Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.ema |