Browse All CVEs
9,500 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40229 |
medium | 5.1 | 0.0018 | 2026-10-29 | Helpy contains a stored cross-site scripting vulnerability in the post author display logi | |
CVE-2026-40230 |
medium | 4.8 | 0.0018 | 2026-10-29 | Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rende | |
CVE-2026-7386 |
medium | 5.5 | 0.0043 | 2026-10-29 | A flaw has been found in fatbobman mail-mcp-bridge up to 1.3.3. Affected is an unknown fun | |
CVE-2026-0205 |
medium | 6.8 | 0.0039 | 2026-10-29 | A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to intera | |
CVE-2026-0206 |
medium | 4.9 | 0.0050 | 2026-10-29 | A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remo | |
CVE-2026-6915 |
medium | 5.3 | 0.0017 | 2026-10-29 | An authorization flaw in the user management command could allow an authenticated user to | |
CVE-2026-7423 |
medium | 6.0 | 0.0022 | 2026-10-29 | Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V | |
CVE-2026-7439 |
medium | 4.8 | 0.0009 | 2026-10-29 | AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/r | |
CVE-2026-7400 |
medium | 5.5 | 0.0043 | 2026-10-29 | A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This | |
CVE-2026-7425 |
medium | 6.0 | 0.0023 | 2026-10-29 | Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS- | |
CVE-2026-7426 |
medium | 6.1 | 0.0025 | 2026-10-29 | Insufficient validation of the prefix length field in IPv6 Router Advertisement processing | |
CVE-2026-1858 |
medium | 4.8 | 0.0015 | 2026-10-29 | wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EK | |
CVE-2026-7403 |
medium | 5.5 | 0.0056 | 2026-10-29 | A security flaw has been discovered in geldata gel-mcp 0.1.0. This impacts the function li | |
CVE-2026-7404 |
medium | 5.5 | 0.0051 | 2026-10-29 | A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected i | |
CVE-2026-7416 |
medium | 5.5 | 0.0179 | 2026-10-29 | A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the fun | |
CVE-2026-7417 |
medium | 5.5 | 0.0036 | 2026-10-29 | A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publis | |
CVE-2026-7443 |
medium | 5.5 | 0.0152 | 2026-10-29 | A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this | |
CVE-2026-7446 |
medium | 5.5 | 0.0154 | 2026-10-29 | A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the funct | |
CVE-2026-7468 |
medium | 5.5 | 0.0036 | 2026-10-29 | A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affe | |
CVE-2026-41226 |
medium | 5.1 | 0.0030 | 2026-10-29 | Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ric | |
CVE-2026-42798 |
medium | 4.0 | 0.0013 | 2026-10-29 | Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in c | |
CVE-2026-5299 |
medium | 5.5 | 0.0012 | 2026-10-29 | ICMPv6 PvD protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows | |
CVE-2026-6522 |
medium | 5.5 | 0.0012 | 2026-10-29 | RPKI-Router protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4. | |
CVE-2026-6524 |
medium | 5.5 | 0.0012 | 2026-10-29 | MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows deni | |
CVE-2026-6526 |
medium | 5.5 | 0.0012 | 2026-10-29 | RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 | |
CVE-2026-6528 |
medium | 5.5 | 0.0014 | 2026-10-29 | TLS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 allows denial of service | |
CVE-2026-6530 |
medium | 5.5 | 0.0016 | 2026-10-29 | DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows d | |
CVE-2026-6533 |
medium | 5.5 | 0.0015 | 2026-10-29 | Dissection engine LZ77 decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 | |
CVE-2026-6538 |
medium | 5.5 | 0.0018 | 2026-10-29 | BEEP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denia | |
CVE-2026-6870 |
medium | 5.5 | 0.0016 | 2026-10-29 | GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows den | |
CVE-2026-41016 |
medium | 5.9 | 0.0027 | 2026-10-29 | Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` withou | |
CVE-2026-42800 |
medium | 5.3 | 0.0024 | 2026-10-29 | NULL pointer dereference vulnerability in ASR1903 in ASR Lapwing_Linux on Linux (ims_clien | |
CVE-2026-1493 |
medium | 4.6 | 0.0018 | 2026-10-29 | LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The applicati | |
CVE-2026-5080 |
medium | 5.9 | 0.0036 | 2026-10-29 | Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurel | |
CVE-2026-7382 |
medium | 6.5 | 0.0034 | 2026-10-29 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal i | |
CVE-2026-7163 |
medium | 5.5 | 0.0019 | 2026-10-29 | A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted | |
CVE-2026-7500 |
medium | 5.4 | 0.0023 | 2026-10-29 | When Keycloak is started with `--features-disabled=account,account-api`, the Account REST | |
CVE-2026-33448 |
medium | 4.8 | 0.0010 | 2026-10-29 | CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access | |
CVE-2026-28532 |
medium | 6.0 | 0.0022 | 2026-10-29 | FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic E | |
CVE-2026-33452 |
medium | 5.9 | 0.0010 | 2026-10-29 | CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access Windows client pri | |
CVE-2026-3340 |
medium | 6.5 | 0.0017 | 2026-10-29 | IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request | |
CVE-2026-3346 |
medium | 6.4 | 0.0016 | 2026-10-29 | IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site script | |
CVE-2026-40949 |
medium | 6.8 | 0.0010 | 2026-10-29 | CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client pri | |
CVE-2026-40951 |
medium | 6.8 | 0.0009 | 2026-10-29 | CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prio | |
CVE-2026-4502 |
medium | 6.5 | 0.0027 | 2026-10-29 | IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to | |
CVE-2026-1577 |
medium | 6.5 | 0.0034 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (incl | |
CVE-2026-3345 |
medium | 6.5 | 0.0037 | 2026-10-29 | IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directorie | |
CVE-2026-28909 |
medium | 6.5 | 0.0020 | 2026-10-29 | Users who connect to malicious registries with hostnames matching the bypass patterns will | |
CVE-2026-7505 |
medium | 5.5 | 0.0038 | 2026-10-29 | A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects | |
CVE-2026-7506 |
medium | 5.5 | 0.0026 | 2026-10-29 | A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts |