Browse All CVEs
13,225 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14371 |
high | 8.8 | 0.0123 | 2026-10-29 | The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below run | |
CVE-2026-45325 |
high | 8.2 | 0.0046 | 2026-10-29 | Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20 | |
CVE-2026-45367 |
high | 7.5 | 0.0068 | 2026-10-29 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperab | |
CVE-2026-45576 |
high | 8.3 | 0.0050 | 2026-10-29 | zrok is software for sharing web services, files, and network resources. From 0.4.23 until | |
CVE-2026-63085 |
high | 8.7 | 0.0054 | 2026-10-29 | Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerab | |
CVE-2026-63088 |
high | 7.7 | 0.0047 | 2026-10-29 | stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that a | |
CVE-2026-46336 |
high | 7.1 | 0.0039 | 2026-10-29 | Manyfold is an open source, self-hosted web application for managing a collection of 3d mo | |
CVE-2026-46513 |
high | 7.4 | 0.0043 | 2026-10-29 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman st | |
CVE-2026-54526 |
high | 8.9 | 0.0055 | 2026-10-29 | Argo Workflows is an open source container-native workflow engine for orchestrating parall | |
CVE-2026-15352 |
high | 8.2 | 0.0061 | 2026-10-29 | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight Syste | |
CVE-2026-44981 |
high | 8.2 | 0.0051 | 2026-10-29 | CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the | |
CVE-2026-44982 |
high | 7.2 | 0.0037 | 2026-10-29 | CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg | |
CVE-2026-49998 |
high | 8.2 | 0.0022 | 2026-10-29 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifu | |
CVE-2026-55629 |
high | 8.7 | 0.0055 | 2026-10-29 | Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/serv | |
CVE-2026-60063 |
high | 7.3 | 0.0015 | 2026-10-29 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to | |
CVE-2026-61389 |
high | 7.3 | 0.0015 | 2026-10-29 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to | |
CVE-2026-62963 |
high | 8.7 | 0.0052 | 2026-10-29 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifu | |
CVE-2026-63397 |
high | 7.1 | 0.0048 | 2026-10-29 | remorses/genql before version 6.3.4 allows an authenticated attacker with control of the G | |
CVE-2024-32386 |
high | 7.3 | 0.0085 | 2026-10-29 | Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_202 | |
CVE-2024-34268 |
high | 7.1 | 0.0032 | 2026-10-29 | EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version | |
CVE-2026-11889 |
high | 7.1 | 0.0031 | 2026-10-29 | SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerabl | |
CVE-2026-33692 |
high | 7.5 | 0.0035 | 2026-10-29 | WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to | |
CVE-2026-44019 |
high | 8.1 | 0.0042 | 2026-10-29 | Docling Core defines core data types and transformations for the document processing appli | |
CVE-2026-44023 |
high | 8.6 | 0.0043 | 2026-10-29 | Docling Core defines core data types and transformations for the document processing appli | |
CVE-2026-53409 |
high | 7.8 | 0.0017 | 2026-10-29 | Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an | |
CVE-2026-53410 |
high | 7.0 | 0.0010 | 2026-10-29 | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallat | |
CVE-2026-55173 |
high | 8.1 | 0.0268 | 2026-10-29 | WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to | |
CVE-2026-44174 |
high | 8.7 | 0.0049 | 2026-10-29 | Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not | |
CVE-2026-44175 |
high | 8.5 | 0.0043 | 2026-10-29 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, K | |
CVE-2026-44177 |
high | 8.8 | 0.0177 | 2026-10-29 | Kirby is an open-source content management system. In versions 5.3.0 and above but prior t | |
CVE-2026-45368 |
high | 8.4 | 0.0053 | 2026-10-29 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, t | |
CVE-2026-53411 |
high | 7.0 | 0.0014 | 2026-10-29 | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallat | |
CVE-2026-57076 |
high | 7.8 | 0.0017 | 2026-10-29 | YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name re | |
CVE-2026-57077 |
high | 7.7 | 0.0019 | 2026-10-29 | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newl | |
CVE-2026-59117 |
high | 7.5 | 0.0061 | 2026-10-29 | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to exec | |
CVE-2026-43977 |
high | 7.5 | 0.0029 | 2026-10-29 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any aut | |
CVE-2026-43978 |
high | 8.1 | 0.0027 | 2026-10-29 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym t | |
CVE-2026-44433 |
high | 7.5 | 0.0049 | 2026-10-29 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O H | |
CVE-2026-44435 |
high | 7.5 | 0.0049 | 2026-10-29 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O H | |
CVE-2026-44436 |
high | 7.5 | 0.0049 | 2026-10-29 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O H | |
CVE-2026-62202 |
high | 7.7 | 0.0054 | 2026-10-29 | OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in | |
CVE-2026-62203 |
high | 7.7 | 0.0053 | 2026-10-29 | OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability | |
CVE-2026-62217 |
high | 7.7 | 0.0045 | 2026-10-29 | OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec | |
CVE-2026-62223 |
high | 7.7 | 0.0045 | 2026-10-29 | OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair | |
CVE-2026-62228 |
high | 7.7 | 0.0045 | 2026-10-29 | OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approv | |
CVE-2026-62229 |
high | 7.7 | 0.0072 | 2026-10-29 | OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist | |
CVE-2026-62230 |
high | 8.7 | 0.0038 | 2026-10-29 | Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) | |
CVE-2026-62231 |
high | 8.6 | 0.0028 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypas | |
CVE-2026-62233 |
high | 8.7 | 0.0044 | 2026-10-29 | grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generat | |
CVE-2026-62234 |
high | 8.4 | 0.0037 | 2026-10-29 | Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authentic |