Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-32774 |
medium | 5.3 | 0.0031 | 2026-11-08 | Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext | |
CVE-2026-32040 |
low | 2.4 | 0.0016 | 2026-11-08 | OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML s | |
CVE-2026-32038 |
critical | 9.3 | 0.0028 | 2026-11-08 | OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that a | |
CVE-2026-29518 |
high | 7.3 | 0.0015 | 2026-11-08 | Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition | |
CVE-2026-29514 |
high | 8.7 | 0.0078 | 2026-11-08 | NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the R | |
CVE-2026-29023 |
medium | 6.9 | 0.0028 | 2026-11-08 | Keygraph Shannon contains a hard-coded API key in its router configuration that, when the | |
CVE-2026-28529 |
high | 8.5 | 0.0018 | 2026-11-08 | cryptodev-linux version 1.14 and prior contain a page reference handling flaw in the get_u | |
CVE-2026-28528 |
low | 2.1 | 0.0014 | 2026-11-08 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in | |
CVE-2026-28527 |
low | 2.1 | 0.0016 | 2026-11-08 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in | |
CVE-2026-28526 |
low | 2.1 | 0.0015 | 2026-11-08 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in | |
CVE-2026-28517 |
critical | 9.3 | 0.0627 | 2026-11-08 | openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerab | |
CVE-2026-28516 |
critical | 9.3 | 0.0107 | 2026-11-08 | openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in | |
CVE-2026-28515 |
critical | 9.3 | 0.0128 | 2026-11-08 | openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerab | |
CVE-2026-27760 |
critical | 9.2 | 0.3297 | 2026-11-08 | OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the instal | |
CVE-2026-27181 |
high | 8.7 | 0.0080 | 2026-11-08 | MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallati | |
CVE-2026-27180 |
critical | 9.3 | 0.0120 | 2026-11-08 | 1 PoC | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code executi |
CVE-2026-27179 |
high | 8.8 | 0.0053 | 2026-11-08 | 1 PoC | MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerabil |
CVE-2026-27178 |
medium | 5.3 | 0.0027 | 2026-11-08 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnera | |
CVE-2026-27177 |
medium | 5.3 | 0.0023 | 2026-11-08 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnera | |
CVE-2026-27176 |
medium | 5.1 | 0.0050 | 2026-11-08 | MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vuln | |
CVE-2026-27175 |
critical | 9.2 | 0.2399 | 2026-11-08 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injectio | |
CVE-2026-27174 |
critical | 9.3 | 0.0685 | 2026-11-08 | 1 PoC | MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the |
CVE-2026-26351 |
medium | 4.8 | 0.0033 | 2026-11-08 | GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a st | |
CVE-2026-26228 |
low | 2.3 | 0.0032 | 2026-11-08 | VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in | |
CVE-2026-26227 |
medium | 6.3 | 0.0033 | 2026-11-08 | VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the R | |
CVE-2026-26226 |
medium | 5.3 | 0.0056 | 2026-11-08 | beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that ca | |
CVE-2026-26217 |
critical | 9.2 | 0.0207 | 2026-11-08 | Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docke | |
CVE-2026-26216 |
critical | 10.0 | 0.0633 | 2026-11-08 | 1 PoC | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Dock |
CVE-2026-26213 |
high | 8.7 | 0.0443 | 2026-11-08 | thingino-firmware versions up to the firmware-2026-03-16 release contains an unauthenticat | |
CVE-2026-25873 |
critical | 9.3 | 0.0125 | 2026-11-08 | OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward | |
CVE-2026-25861 |
high | 8.2 | 0.0018 | 2026-11-08 | QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vu | |
CVE-2026-25554 |
high | 8.3 | 0.0036 | 2026-11-08 | OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33 | |
CVE-2026-24425 |
high | 8.7 | 0.0076 | 2026-11-08 | Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when | |
CVE-2026-23749 |
low | 2.1 | 0.0018 | 2026-11-08 | Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an | |
CVE-2026-23748 |
medium | 6.3 | 0.0031 | 2026-11-08 | Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an | |
CVE-2026-23747 |
medium | 6.3 | 0.0034 | 2026-11-08 | Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a st | |
CVE-2026-23679 |
medium | 6.9 | 0.0018 | 2026-11-08 | libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows | |
CVE-2026-22681 |
high | 8.3 | 0.0034 | 2026-11-08 | OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows a | |
CVE-2026-22675 |
medium | 5.1 | 0.0022 | 2026-11-08 | OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vul | |
CVE-2026-22665 |
high | 8.6 | 0.0034 | 2026-11-08 | prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to | |
CVE-2026-22663 |
high | 8.7 | 0.0028 | 2026-11-08 | prompts.chat prior to commit 7b81836 contains multiple authorization bypass vulnerabilitie | |
CVE-2026-22662 |
medium | 5.3 | 0.0020 | 2026-11-08 | prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerab | |
CVE-2026-22661 |
high | 8.6 | 0.0037 | 2026-11-08 | prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file | |
CVE-2026-22219 |
high | 8.3 | 0.0517 | 2026-11-08 | Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerabilit | |
CVE-2026-22218 |
high | 7.1 | 0.0972 | 2026-11-08 | Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /proj | |
CVE-2026-22207 |
critical | 9.3 | 0.0049 | 2026-11-08 | OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access contr | |
CVE-2026-22200 |
high | 8.7 | 0.7359 | 2026-11-08 | 1 PoC | Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an |
CVE-2026-22186 |
medium | 4.6 | 0.0017 | 2026-11-08 | Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulner | |
CVE-2026-22177 |
medium | 6.9 | 0.0042 | 2026-11-08 | OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment | |
CVE-2026-1776 |
medium | 6.0 | 0.0083 | 2026-11-08 | Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path trave |