Browse All CVEs
13,263 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40454 |
high | 7.5 | 0.0049 | 2026-10-29 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Ou | |
CVE-2026-41876 |
high | 8.7 | 0.0123 | 2026-10-29 | R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The docume | |
CVE-2026-41878 |
high | 7.1 | 0.0047 | 2026-10-29 | R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple fil | |
CVE-2026-41879 |
high | 8.2 | 0.0027 | 2026-10-29 | R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows a | |
CVE-2026-56689 |
high | 7.7 | 0.0037 | 2026-10-29 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of | |
CVE-2026-56690 |
high | 8.5 | 0.0032 | 2026-10-29 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of | |
CVE-2026-54469 |
high | 8.8 | 0.0086 | 2026-10-29 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization o | |
CVE-2026-56254 |
high | 8.3 | 0.0019 | 2026-10-29 | In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption sche | |
CVE-2026-56305 |
high | 8.7 | 0.0045 | 2026-10-29 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the password chan | |
CVE-2026-56335 |
high | 7.1 | 0.0036 | 2026-10-29 | Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped AP | |
CVE-2026-59793 |
high | 8.8 | 0.0049 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce | |
CVE-2026-59796 |
high | 8.1 | 0.0035 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper p | |
CVE-2026-61434 |
high | 8.7 | 0.0073 | 2026-10-29 | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell comman | |
CVE-2026-61437 |
high | 8.5 | 0.0020 | 2026-10-29 | PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module lo | |
CVE-2026-61441 |
high | 7.1 | 0.0029 | 2026-10-29 | PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of iss | |
CVE-2026-61450 |
high | 7.1 | 0.0542 | 2026-10-29 | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.page | |
CVE-2026-61455 |
high | 7.1 | 0.0030 | 2026-10-29 | Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() th | |
CVE-2026-33382 |
high | 7.5 | 0.0039 | 2026-10-29 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the | |
CVE-2026-54149 |
high | 8.8 | 0.0049 | 2026-10-29 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool impor | |
CVE-2026-55501 |
high | 7.3 | 0.0038 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter i | |
CVE-2026-56676 |
high | 7.4 | 0.0019 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by res | |
CVE-2026-8609 |
high | 7.5 | 0.0040 | 2026-10-29 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique va | |
CVE-2026-2398 |
high | 8.8 | 0.0045 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation L | |
CVE-2026-39903 |
high | 7.1 | 0.0047 | 2026-10-29 | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains | |
CVE-2026-53653 |
high | 8.7 | 0.0052 | 2026-10-29 | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthen | |
CVE-2026-53657 |
high | 8.2 | 0.0020 | 2026-10-29 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to | |
CVE-2026-54063 |
high | 7.5 | 0.0061 | 2026-10-29 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Pr | |
CVE-2026-54919 |
high | 7.4 | 0.0026 | 2026-10-29 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affec | |
CVE-2026-55638 |
high | 8.6 | 0.0658 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api | |
CVE-2026-55641 |
high | 8.2 | 0.0033 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LL | |
CVE-2026-55687 |
high | 7.5 | 0.0070 | 2026-10-29 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5 | |
CVE-2026-56675 |
high | 8.3 | 0.0050 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as | |
CVE-2026-59161 |
high | 8.7 | 0.0066 | 2026-10-29 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Pr | |
CVE-2026-59190 |
high | 8.7 | 0.0027 | 2026-10-29 | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and crea | |
CVE-2026-54329 |
high | 7.7 | 0.0039 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API cre | |
CVE-2026-55460 |
high | 7.1 | 0.0044 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-ad | |
CVE-2026-55474 |
high | 7.1 | 0.0048 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::di | |
CVE-2026-55516 |
high | 7.7 | 0.0038 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/ma | |
CVE-2026-55843 |
high | 7.0 | 0.0054 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update | |
CVE-2026-61460 |
high | 8.7 | 0.0051 | 2026-10-29 | Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in Lea | |
CVE-2026-61461 |
high | 8.7 | 0.0050 | 2026-10-29 | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store | |
CVE-2026-6212 |
high | 8.8 | 0.0044 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Teracity Software Techno | |
CVE-2026-11321 |
high | 7.1 | 0.0042 | 2026-10-29 | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV f | |
CVE-2026-55377 |
high | 8.1 | 0.0040 | 2026-10-29 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0 | |
CVE-2026-55789 |
high | 8.5 | 0.0034 | 2026-10-29 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0 | |
CVE-2026-34196 |
high | 7.8 | 0.0017 | 2026-10-29 | Software installed and run as a non-privileged user may conduct improper GPU system calls | |
CVE-2026-41154 |
high | 7.8 | 0.0018 | 2026-10-29 | Software installed and run as a non-privileged user may cause OOB kernel memory reads or w | |
CVE-2026-45196 |
high | 7.8 | 0.0014 | 2026-10-29 | Kernel software installed and running inside a Host VM may post improper commands to the G | |
CVE-2026-45203 |
high | 7.8 | 0.0013 | 2026-10-29 | Kernel software installed and running inside a Host VM may post improper commands to the G | |
CVE-2026-55659 |
high | 7.7 | 0.0036 | 2026-10-29 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, sever |