Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56214 |
high | 8.7 | 0.0046 | 2026-11-08 | Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgRE | |
CVE-2026-56213 |
medium | 6.9 | 0.0035 | 2026-11-08 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_ | |
CVE-2026-56104 |
high | 8.8 | 0.0042 | 2026-11-08 | Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthentica | |
CVE-2026-56079 |
high | 7.1 | 0.0041 | 2026-11-08 | Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgR | |
CVE-2026-56078 |
high | 8.7 | 0.0092 | 2026-11-08 | PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that | |
CVE-2026-56077 |
high | 7.1 | 0.0044 | 2026-11-08 | PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgen | |
CVE-2026-56076 |
high | 8.6 | 0.0064 | 2026-11-08 | PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI | |
CVE-2026-56075 |
high | 8.7 | 0.0060 | 2026-11-08 | PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where | |
CVE-2026-55199 |
high | 8.2 | 0.0092 | 2026-11-08 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of s | |
CVE-2026-54388 |
critical | 9.3 | 0.0044 | 2026-11-08 | Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing mul | |
CVE-2026-54387 |
critical | 9.3 | 0.0044 | 2026-11-08 | Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content- | |
CVE-2026-53989 |
medium | 5.3 | 0.0026 | 2026-11-08 | Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endp | |
CVE-2026-53988 |
critical | 9.2 | 0.0045 | 2026-11-08 | Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook | |
CVE-2026-53981 |
high | 7.2 | 0.0027 | 2026-11-08 | Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change me | |
CVE-2026-53874 |
critical | 9.3 | 0.0052 | 2026-11-08 | picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthen | |
CVE-2026-53873 |
critical | 9.3 | 0.0046 | 2026-11-08 | picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails | |
CVE-2026-53872 |
high | 8.7 | 0.0051 | 2026-11-08 | picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing | |
CVE-2026-53868 |
high | 8.7 | 0.0026 | 2026-11-08 | Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to reg | |
CVE-2026-53867 |
medium | 5.3 | 0.0018 | 2026-11-08 | Capgo before 12.128.2 fails to delete previously uploaded profile images from backend stor | |
CVE-2026-50636 |
high | 8.8 | 0.0036 | 2026-11-08 | The RemoteControl API methods invite_participants and remind_participants pass a caller-su | |
CVE-2026-50635 |
high | 8.8 | 0.0037 | 2026-11-08 | LimeSurvey constructs account password-reset links from the client-supplied HTTP Host head | |
CVE-2026-49959 |
high | 8.7 | 0.0095 | 2026-11-08 | Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that a | |
CVE-2026-49958 |
medium | 4.3 | 0.0008 | 2026-11-08 | Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race co | |
CVE-2026-49957 |
medium | 6.3 | 0.0042 | 2026-11-08 | Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability th | |
CVE-2026-49956 |
high | 7.1 | 0.0027 | 2026-11-08 | Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability tha | |
CVE-2026-49955 |
medium | 6.9 | 0.0059 | 2026-11-08 | Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that all | |
CVE-2026-49948 |
high | 8.6 | 0.0029 | 2026-11-08 | Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vuln | |
CVE-2026-49490 |
high | 8.6 | 0.0025 | 2026-11-08 | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter ha | |
CVE-2026-49489 |
high | 8.4 | 0.0026 | 2026-11-08 | OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection param | |
CVE-2026-49144 |
high | 7.1 | 0.0042 | 2026-11-08 | BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default | |
CVE-2026-49143 |
high | 8.7 | 0.0080 | 2026-11-08 | BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_ | |
CVE-2026-49141 |
medium | 5.1 | 0.0022 | 2026-11-08 | WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automat | |
CVE-2026-49140 |
medium | 5.3 | 0.0027 | 2026-11-08 | Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix ch | |
CVE-2026-49139 |
high | 7.0 | 0.0038 | 2026-11-08 | Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the | |
CVE-2026-49138 |
medium | 5.3 | 0.0036 | 2026-11-08 | Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the | |
CVE-2026-49136 |
high | 8.7 | 0.0042 | 2026-11-08 | Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerab | |
CVE-2026-49135 |
high | 7.2 | 0.0013 | 2026-11-08 | CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that a | |
CVE-2026-49134 |
high | 7.5 | 0.0027 | 2026-11-08 | CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installe | |
CVE-2026-49133 |
high | 7.1 | 0.0034 | 2026-11-08 | Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated a | |
CVE-2026-49121 |
critical | 9.2 | 0.0110 | 2026-11-08 | AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code e | |
CVE-2026-49120 |
medium | 6.3 | 0.0023 | 2026-11-08 | Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscrip | |
CVE-2026-48557 |
high | 8.7 | 0.0044 | 2026-11-08 | Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction byp | |
CVE-2026-48555 |
medium | 5.3 | 0.0025 | 2026-11-08 | Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery | |
CVE-2026-48547 |
high | 8.5 | 0.0091 | 2026-11-08 | KanaDojo contains a command injection vulnerability that allows an attacker with pull requ | |
CVE-2026-48545 |
high | 7.6 | 0.0035 | 2026-11-08 | Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote | |
CVE-2026-48249 |
high | 8.2 | 0.0017 | 2026-11-08 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_lo | |
CVE-2026-48248 |
high | 8.2 | 0.0021 | 2026-11-08 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.ph | |
CVE-2026-48247 |
high | 8.2 | 0.0017 | 2026-11-08 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.in | |
CVE-2026-48243 |
medium | 6.9 | 0.0022 | 2026-11-08 | Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1 | |
CVE-2026-48241 |
critical | 9.2 | 0.0031 | 2026-11-08 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.ph |