Browse All CVEs
10,425 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49072 |
medium | 6.5 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. | |
CVE-2026-54196 |
medium | 6.8 | 0.0024 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privileg | |
CVE-2026-52716 |
medium | 6.5 | 0.0034 | 2026-10-29 | Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions. | |
CVE-2026-54817 |
medium | 6.5 | 0.0025 | 2026-10-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MSto | |
CVE-2026-35162 |
medium | 6.5 | 0.0021 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control | |
CVE-2026-40641 |
medium | 4.8 | 0.0010 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risk | |
CVE-2026-48117 |
medium | 6.8 | 0.0018 | 2026-10-29 | DroneAware is a drone detection platform. The centralized DroneAware server backing dronea | |
CVE-2026-55748 |
medium | 6.8 | 0.0025 | 2026-10-29 | OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that ma | |
CVE-2026-1288 |
medium | 5.5 | 0.0012 | 2026-10-29 | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Au | |
CVE-2026-20220 |
medium | 6.3 | 0.0025 | 2026-10-29 | A vulnerability in the web-based management interface of Cisco Crosswork Network Controlle | |
CVE-2026-20246 |
medium | 6.0 | 0.0010 | 2026-10-29 | A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an auth | |
CVE-2026-35068 |
medium | 5.7 | 0.0019 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization | |
CVE-2026-20178 |
medium | 4.3 | 0.0020 | 2026-10-29 | A vulnerability in the browser-based version of Cisco Webex App could have allowed an unau | |
CVE-2026-20265 |
medium | 4.3 | 0.0022 | 2026-10-29 | In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "a | |
CVE-2026-2674 |
medium | 4.8 | 0.0018 | 2026-10-29 | Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service,Core Libra | |
CVE-2026-2675 |
medium | 6.0 | 0.0021 | 2026-10-29 | Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Se | |
CVE-2026-30799 |
medium | 6.1 | 0.0026 | 2026-10-29 | Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Se | |
CVE-2026-48591 |
medium | 4.8 | 0.0013 | 2026-10-29 | Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave ea | |
CVE-2026-53870 |
medium | 6.8 | 0.0016 | 2026-10-29 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with w | |
CVE-2026-10741 |
medium | 5.9 | 0.0027 | 2026-10-29 | Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in | |
CVE-2026-12529 |
medium | 6.9 | 0.0028 | 2026-10-29 | A security vulnerability has been detected in SourceCodester CET Automated Grading System | |
CVE-2026-48817 |
medium | 5.3 | 0.0021 | 2026-10-29 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispa | |
CVE-2026-48990 |
medium | 5.3 | 0.0016 | 2026-10-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing | |
CVE-2026-54386 |
medium | 5.1 | 0.0024 | 2026-10-29 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebo | |
CVE-2026-8049 |
medium | 5.3 | 0.0011 | 2026-10-29 | In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without | |
CVE-2024-27928 |
medium | 5.9 | 0.0028 | 2026-10-29 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to versio | |
CVE-2026-12565 |
medium | 5.3 | 0.0021 | 2026-10-29 | The unarchive internal module's archive extraction commands perform no code-level validati | |
CVE-2026-12568 |
medium | 6.5 | 0.0025 | 2026-10-29 | The postman_download module uses the workspace name field from the Postman API to construc | |
CVE-2026-44644 |
medium | 6.1 | 0.0025 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-44645 |
medium | 6.5 | 0.0039 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-44646 |
medium | 5.3 | 0.0033 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-50267 |
medium | 4.7 | 0.0006 | 2026-10-29 | Steeltoe is an open source project that provides a collection of libraries that helps user | |
CVE-2026-50643 |
medium | 5.1 | 0.0014 | 2026-10-29 | 8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives an | |
CVE-2026-12039 |
medium | 5.7 | 0.0010 | 2026-10-29 | Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to D | |
CVE-2026-12527 |
medium | 6.0 | 0.0022 | 2026-10-29 | A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian C | |
CVE-2026-12539 |
medium | 5.7 | 0.0014 | 2026-10-29 | Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creat | |
CVE-2026-44942 |
medium | 6.5 | 0.0042 | 2026-10-29 | A path traversal in handling the "path" component of .repo files processed by libzypp befo | |
CVE-2026-54219 |
medium | 5.1 | 0.0029 | 2026-10-29 | UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The applic | |
CVE-2026-54221 |
medium | 5.1 | 0.0029 | 2026-10-29 | UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input | |
CVE-2026-56007 |
medium | 5.9 | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-56009 |
medium | 5.9 | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-9158 |
medium | 5.2 | 0.0060 | 2026-10-29 | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection comm | |
CVE-2026-22551 |
medium | 6.7 | 0.0031 | 2026-10-29 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from A | |
CVE-2026-11982 |
medium | 5.1 | 0.0038 | 2026-10-29 | Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulne | |
CVE-2026-55205 |
medium | 6.9 | 0.0052 | 2026-10-29 | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthent | |
CVE-2026-56024 |
medium | 6.5 | 0.0018 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site | |
CVE-2026-48984 |
medium | 4.7 | 0.0015 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-48985 |
medium | 5.5 | 0.0016 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-48986 |
medium | 4.7 | 0.0014 | 2026-10-29 | pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 | |
CVE-2026-47833 |
medium | 6.9 | 0.0017 | 2026-10-29 | setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege esca |