Browse All CVEs
13,232 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42049 |
high | 8.4 | 0.0020 | 2026-10-29 | jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName val | |
CVE-2026-46627 |
high | 7.1 | 0.0054 | 2026-10-29 | Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a | |
CVE-2026-46633 |
high | 8.7 | 0.0069 | 2026-10-29 | Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape s | |
CVE-2026-46634 |
high | 7.7 | 0.0062 | 2026-10-29 | Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compi | |
CVE-2026-46639 |
high | 7.1 | 0.0039 | 2026-10-29 | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assign | |
CVE-2026-46640 |
high | 8.7 | 0.0064 | 2026-10-29 | Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import | |
CVE-2026-47732 |
high | 7.1 | 0.0040 | 2026-10-29 | Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs tri | |
CVE-2026-48806 |
high | 7.1 | 0.0042 | 2026-10-29 | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynam | |
CVE-2026-48807 |
high | 7.1 | 0.0037 | 2026-10-29 | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do n | |
CVE-2026-54684 |
high | 7.0 | 0.0020 | 2026-10-29 | jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause ja | |
CVE-2026-8919 |
high | 7.2 | 0.0045 | 2026-10-29 | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a re | |
CVE-2026-8920 |
high | 8.5 | 0.0011 | 2026-10-29 | Improper Restriction of Communication Channel to Intended Endpoints and External Control o | |
CVE-2026-42936 |
high | 8.4 | 0.0018 | 2026-10-29 | The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafte | |
CVE-2026-14251 |
high | 7.7 | 0.0039 | 2026-10-29 | A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not val | |
CVE-2026-15583 |
high | 8.6 | 0.0053 | 2026-10-29 | A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to | |
CVE-2026-15804 |
high | 8.7 | 0.0054 | 2026-10-29 | The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote atta | |
CVE-2026-57831 |
high | 8.7 | 0.0040 | 2026-10-29 | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8 | |
CVE-2026-57832 |
high | 8.7 | 0.0040 | 2026-10-29 | Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 | |
CVE-2026-35152 |
high | 8.8 | 0.0328 | 2026-10-29 | A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports | |
CVE-2026-56287 |
high | 8.1 | 0.0065 | 2026-10-29 | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API | |
CVE-2026-57821 |
high | 8.1 | 0.0074 | 2026-10-29 | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/o | |
CVE-2026-57833 |
high | 8.6 | 0.0044 | 2026-10-29 | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joo | |
CVE-2026-58077 |
high | 8.7 | 0.0044 | 2026-10-29 | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joo | |
CVE-2026-59235 |
high | 8.7 | 0.0066 | 2026-10-29 | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/Ban | |
CVE-2026-56339 |
high | 8.7 | 0.0036 | 2026-10-29 | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in t | |
CVE-2026-58655 |
high | 8.7 | 0.0142 | 2026-10-29 | The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 conta | |
CVE-2026-60085 |
high | 8.7 | 0.0026 | 2026-10-29 | PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the defaul | |
CVE-2026-61430 |
high | 8.4 | 0.0025 | 2026-10-29 | PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_cr | |
CVE-2026-61433 |
high | 8.5 | 0.0021 | 2026-10-29 | PraisonAI before 4.6.78 fails to safely encode deployment configuration values when genera | |
CVE-2026-61435 |
high | 8.8 | 0.0049 | 2026-10-29 | PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation | |
CVE-2026-61436 |
high | 8.8 | 0.0039 | 2026-10-29 | PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, | |
CVE-2026-61438 |
high | 7.0 | 0.0031 | 2026-10-29 | PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecu | |
CVE-2026-61440 |
high | 7.1 | 0.0026 | 2026-10-29 | PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutation | |
CVE-2026-61443 |
high | 8.6 | 0.0064 | 2026-10-29 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_s | |
CVE-2026-61446 |
high | 8.6 | 0.0034 | 2026-10-29 | PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability i | |
CVE-2026-61449 |
high | 7.1 | 0.0030 | 2026-10-29 | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. | |
CVE-2026-61873 |
high | 7.2 | 0.0031 | 2026-10-29 | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's proc | |
CVE-2026-46458 |
high | 7.1 | 0.0036 | 2026-10-29 | ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive | |
CVE-2026-43637 |
high | 8.8 | 0.0066 | 2026-10-29 | Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attacke | |
CVE-2026-52865 |
high | 7.1 | 0.0050 | 2026-10-29 | When NGINX Ingress Controller processes Ingress or TransportServer resources, an authentic | |
CVE-2026-55723 |
high | 8.7 | 0.0051 | 2026-10-29 | When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ing | |
CVE-2026-61644 |
high | 7.7 | 0.0031 | 2026-10-29 | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the | |
CVE-2026-61684 |
high | 8.8 | 0.0039 | 2026-10-29 | FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invo | |
CVE-2026-46709 |
high | 7.8 | 0.0025 | 2026-10-29 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Ta | |
CVE-2026-47158 |
high | 8.3 | 0.0025 | 2026-10-29 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden | |
CVE-2026-47164 |
high | 7.7 | 0.0045 | 2026-10-29 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden | |
CVE-2026-55242 |
high | 8.8 | 0.0020 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and | |
CVE-2026-61828 |
high | 8.5 | 0.0015 | 2026-10-29 | Nixpkgs is a collection of software packages that can be installed with the Nix package ma | |
CVE-2026-20150 |
high | 8.8 | 0.0042 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-20153 |
high | 7.5 | 0.0047 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco |