Browse All CVEs
13,222 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-22104 |
high | 7.1 | 0.0045 | 2026-10-29 | Improper access control in Hashtopolis server web-interface chunk activity component for v | |
CVE-2026-59252 |
high | 8.2 | 0.0046 | 2026-10-29 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticate | |
CVE-2026-59694 |
high | 8.3 | 0.0052 | 2026-10-29 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticate | |
CVE-2026-59695 |
high | 8.3 | 0.0052 | 2026-10-29 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticate | |
CVE-2026-13410 |
high | 8.2 | 0.0038 | 2026-10-29 | Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. | |
CVE-2026-7189 |
high | 7.5 | 0.0042 | 2026-10-29 | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co | |
CVE-2026-8396 |
high | 7.5 | 0.0044 | 2026-10-29 | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc | |
CVE-2026-7488 |
high | 7.5 | 0.0042 | 2026-10-29 | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E- | |
CVE-2026-9592 |
high | 7.5 | 0.0024 | 2026-10-29 | SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker | |
CVE-2026-63093 |
high | 8.7 | 0.0085 | 2026-10-29 | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows rem | |
CVE-2026-12715 |
high | 8.5 | 0.0035 | 2026-10-29 | Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Goog | |
CVE-2026-14741 |
high | 7.5 | 0.0063 | 2026-10-29 | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtra | |
CVE-2026-15343 |
high | 8.6 | 0.0075 | 2026-10-29 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an | |
CVE-2026-58148 |
high | 8.7 | 0.0044 | 2026-10-29 | Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - | |
CVE-2026-60025 |
high | 8.8 | 0.0020 | 2026-10-29 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joo | |
CVE-2026-63095 |
high | 7.1 | 0.0030 | 2026-10-29 | Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Cli | |
CVE-2026-63099 |
high | 7.1 | 0.0035 | 2026-10-29 | TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the a | |
CVE-2026-63100 |
high | 7.1 | 0.0035 | 2026-10-29 | Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticat | |
CVE-2026-12691 |
high | 7.5 | 0.0052 | 2026-10-29 | Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Vid | |
CVE-2026-57860 |
high | 8.4 | 0.0021 | 2026-10-29 | ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and exec | |
CVE-2026-63101 |
high | 8.7 | 0.0052 | 2026-10-29 | Open Event Server through 1.19.1 contains a missing authentication vulnerability that allo | |
CVE-2026-63307 |
high | 7.1 | 0.0040 | 2026-10-29 | Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET | |
CVE-2026-9585 |
high | 8.6 | 0.0055 | 2026-10-29 | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Sw | |
CVE-2026-9587 |
high | 7.1 | 0.0038 | 2026-10-29 | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Editio | |
CVE-2026-9588 |
high | 7.0 | 0.0040 | 2026-10-29 | A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition | |
CVE-2026-50273 |
high | 7.5 | 0.0079 | 2026-10-29 | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3. | |
CVE-2026-9762 |
high | 7.8 | 0.0024 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code exec | |
CVE-2026-45309 |
high | 8.2 | 0.0059 | 2026-10-29 | AsyncSSH is a Python package which provides an asynchronous client and server implementati | |
CVE-2026-49835 |
high | 7.5 | 0.0074 | 2026-10-29 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, | |
CVE-2026-52746 |
high | 7.5 | 0.0069 | 2026-10-29 | JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious n | |
CVE-2026-53712 |
high | 8.2 | 0.0026 | 2026-10-29 | SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple | |
CVE-2026-58195 |
high | 8.8 | 0.0056 | 2026-10-29 | Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP serv | |
CVE-2026-9171 |
high | 7.5 | 0.0055 | 2026-10-29 | IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable t | |
CVE-2026-14499 |
high | 8.8 | 0.0066 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execut | |
CVE-2026-14971 |
high | 7.0 | 0.0013 | 2026-10-29 | IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misco | |
CVE-2026-14979 |
high | 7.5 | 0.0055 | 2026-10-29 | IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7. | |
CVE-2026-15322 |
high | 7.5 | 0.0052 | 2026-10-29 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sen | |
CVE-2026-44974 |
high | 7.7 | 0.0047 | 2026-10-29 | @hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition | |
CVE-2026-45799 |
high | 7.5 | 0.0073 | 2026-10-29 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3 | |
CVE-2026-48373 |
high | 7.8 | 0.0034 | 2026-10-29 | Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result | |
CVE-2026-49834 |
high | 7.5 | 0.0018 | 2026-10-29 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verif | |
CVE-2026-49852 |
high | 8.7 | 0.0017 | 2026-10-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing | |
CVE-2026-4942 |
high | 7.5 | 0.0043 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted | |
CVE-2026-50151 |
high | 7.5 | 0.0038 | 2026-10-29 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/reposi | |
CVE-2026-50163 |
high | 7.1 | 0.0040 | 2026-10-29 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in cont | |
CVE-2026-50197 |
high | 7.8 | 0.0051 | 2026-10-29 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zal | |
CVE-2026-50289 |
high | 8.7 | 0.0218 | 2026-10-29 | systeminformation is a System and OS information library for node.js. Prior to 5.31.7, net | |
CVE-2026-7667 |
high | 8.8 | 0.0056 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicio | |
CVE-2026-7755 |
high | 8.8 | 0.0075 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to in | |
CVE-2026-7872 |
high | 8.1 | 0.0062 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary f |